CVE-2025-46421: libsoup2.4

CVSS: 6.8v3.1MediumDeferred

AliasesUBUNTU-CVE-2025-46421DEBIAN-CVE-2025-46421

Published 24-04-2025Last modified 25-07-2026

Vulnerability summary

CVE-2025-46421 is a medium (CVSS 6.8) vulnerability in libsoup2.4. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46.3% of scored vulnerabilities.

Overall risk

27/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.8/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.57%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

24-04-2025
PublishedVulnerability first disclosed.
25-07-2026
Last modifiedVulnerability information updated.

Description

A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.

CVSS metrics

4 scores · 4 sources · 1 version

v3.16.8

EPSS trend

Probability

0.57%

Chance of exploitation in the next 30 days

Percentile

46%

Versus all other CVEs

30-day change

0.00 pp

From 0.57% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.57%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-497Exposure of Sensitive System Information to an Unauthorized Control SphereThe product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Affected systems

Debian2 products

libsoup2.4All versions (No fix recorded)
libsoup3< 3.2.3-0+deb12u1 | < 3.6.5-1

Ubuntu2 products

libsoup2.4< 2.52.2-1ubuntu0.3+esm1 | < 2.62.1-1ubuntu0.4+esm2 | < 2.70.0-1ubuntu0.3 | < 2.74.2-3ubuntu0.3 | < 2.74.3-6ubuntu1.3 | < 2.74.3-10.1ubuntu1
libsoup3< 3.0.7-0ubuntu1+esm3 | < 3.4.4-5ubuntu0.3

2 vendors · 4 products