CVE-2025-14523: libsoup Auth Bypass Vulnerability

CVE-2025-14523 Overview

CVE-2025-14523 is an HTTP Request Smuggling vulnerability in libsoup, the GNOME HTTP client/server library. The flaw exists in libsoup's HTTP header handling logic, which improperly allows multiple Host: headers in a single HTTP request and returns only the last occurrence for server-side processing. This behavior creates a dangerous mismatch with common front-end proxies that typically honor the first Host: header, enabling virtual host (vhost) confusion attacks.

When exploited, this vulnerability allows attackers to craft malicious requests with duplicate Host: headers that cause a proxy to route the request to one backend server while the libsoup-based backend interprets it as destined for a different host. This discrepancy opens the door to request-smuggling style attacks, cache poisoning, and bypassing host-based access controls.

Critical Impact

Attackers can bypass security controls and manipulate request routing through HTTP header smuggling, potentially gaining unauthorized access to protected resources or poisoning cache entries.

Affected Products

• libsoup (GNOME HTTP library)
• Applications and services built on libsoup
• Red Hat Enterprise Linux and related distributions using affected libsoup versions

Discovery Timeline

• 2025-12-11 - CVE-2025-14523 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2025-14523

Vulnerability Analysis

This vulnerability is classified under CWE-444 (Inconsistent Interpretation of HTTP Requests), commonly referred to as HTTP Request Smuggling. The core issue stems from how libsoup handles the presence of multiple Host: headers in an HTTP/1.1 request.

According to RFC 7230, an HTTP/1.1 request must contain exactly one Host: header field. When a server receives a request with multiple Host: headers, it should reject the request with a 400 Bad Request response. However, libsoup fails to enforce this requirement and instead accepts the request, using the last Host: header value for routing decisions.

This creates a semantic gap between front-end infrastructure (proxies, CDNs, load balancers) and the libsoup-based backend. Most front-end proxies follow a "first occurrence wins" approach when encountering duplicate headers, while libsoup uses the last occurrence. An attacker can exploit this inconsistency to:

• Bypass host-based access controls: Access restricted virtual hosts by tricking the proxy into routing to an allowed host while the backend processes the request for a restricted host
• Poison web caches: Store malicious content in cache entries for legitimate hosts
• Perform request smuggling: Chain requests in ways that bypass security filters or access unintended endpoints

Root Cause

The root cause is improper validation of HTTP request headers in libsoup's parsing logic. The library does not enforce the HTTP/1.1 specification requirement that requests contain exactly one Host: header. Instead of rejecting requests with duplicate Host: headers or using consistent behavior with common proxy implementations, libsoup silently accepts the malformed request and processes the final occurrence of the header.

This permissive parsing behavior violates the principle of strict HTTP compliance and creates exploitable inconsistencies in multi-tier web architectures where libsoup operates behind reverse proxies or load balancers.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted HTTP requests containing duplicate Host: headers to any web application or service using a vulnerable version of libsoup behind a proxy.

A typical attack scenario involves crafting an HTTP request with two Host: headers:

The request would contain a first Host: header pointing to an allowed or public virtual host (which the front-end proxy uses for routing decisions) and a second Host: header pointing to a restricted or internal virtual host (which libsoup uses for processing). This allows the attacker to route requests through the proxy to one backend while the backend interprets the request as targeting a different, potentially restricted host.

For detailed technical information, see the GNOME Issue #472 on GitLab and the Red Hat Bug Report #2421349.

Detection Methods for CVE-2025-14523

Indicators of Compromise

• HTTP requests containing multiple Host: headers in access logs
• Unusual cache behavior or cache entries for unexpected virtual hosts
• Access log entries showing requests routed to unexpected backend virtual hosts
• Discrepancies between proxy access logs and backend application logs for the same requests

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block HTTP requests with duplicate Host: headers
• Configure front-end proxies and load balancers to reject malformed requests before they reach backend servers
• Deploy network monitoring to identify suspicious request patterns targeting HTTP header manipulation
• Use SentinelOne Singularity to monitor for anomalous network traffic patterns indicative of request smuggling attempts

Monitoring Recommendations

• Enable detailed HTTP header logging on both proxy and backend servers to identify header discrepancies
• Monitor for cache pollution incidents by tracking unusual cache hit/miss patterns
• Set up alerts for requests that result in unexpected virtual host resolution on backend servers
• Review application logs for evidence of unauthorized access to restricted virtual hosts

How to Mitigate CVE-2025-14523

Immediate Actions Required

• Update libsoup to the latest patched version available from your distribution
• Configure front-end proxies to normalize or reject requests with duplicate Host: headers
• Implement strict HTTP header validation at the edge of your network infrastructure
• Review access logs for evidence of exploitation attempts

Patch Information

Red Hat has released multiple security advisories addressing this vulnerability across their product lines. Organizations using Red Hat Enterprise Linux or related distributions should apply the relevant updates:

• RHSA-2026:0421, RHSA-2026:0422, RHSA-2026:0423
• RHSA-2026:0836, RHSA-2026:0867, RHSA-2026:0868
• RHSA-2026:0905 through RHSA-2026:0911
• RHSA-2026:1509, RHSA-2026:1569 through RHSA-2026:1572

For additional details, see the CVE-2025-14523 Red Hat Security Info page.

Workarounds

• Configure your reverse proxy or load balancer to strip duplicate Host: headers before forwarding requests to backend servers
• Implement request validation middleware that rejects HTTP requests containing multiple Host: headers
• Use WAF rules to block requests that do not conform to strict HTTP/1.1 header requirements
• Consider network segmentation to limit exposure of libsoup-based services to untrusted networks

# Example nginx configuration to reject duplicate Host headers
# Add to server or location block
if ($http_host ~ ".*,.*") {
    return 400;
}

# Alternative: Use map to detect multiple Host header patterns
map $http_host $bad_host {
    default 0;
    "~.*,.*" 1;
}