CVE-2025-9901: libsoup Cache Information Disclosure Flaw

CVE-2025-9901 Overview

CVE-2025-9901 is a flaw in libsoup, the HTTP client library used by GNOME applications and various Linux components. The vulnerability resides in SoupCache, the library's HTTP caching mechanism, which fails to evaluate the HTTP Vary header when reusing cached responses. The Vary header instructs caches to differentiate responses based on request headers such as Accept-Language, Authorization, or Cookie. Without this check, SoupCache may serve one user's cached response to another request that should have received distinct content. The flaw is classified under [CWE-524: Use of Cache Containing Sensitive Information].

Critical Impact
Cached HTTP responses can be reused across differing requests, enabling confidentiality breaches in proxy or multi-user environments where authenticated or language-specific content is cached.

Affected Products

GNOME libsoup (SoupCache component)
Red Hat Enterprise Linux distributions shipping libsoup
Applications and desktop environments depending on libsoup for HTTP caching

Discovery Timeline

2025-09-03 - CVE-2025-9901 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2025-9901

Vulnerability Analysis

The flaw exists in the SoupCache module of libsoup, which implements client-side HTTP caching per RFC 7234. When a client issues an HTTP request, SoupCache looks up prior responses stored under the request URI. RFC 7234 requires that a cache honor the Vary response header, which lists the request headers that must match between the original and subsequent requests for a cached entry to be reused.

SoupCache omits this validation. Any cached response for a given URI can be returned regardless of whether the new request carries different Accept-Language, Authorization, Cookie, or User-Agent values. This defeats content negotiation and per-user response isolation.

Exploitation requires an environment where libsoup caches responses shared across principals, such as a shared proxy, a multi-user workstation, or an application that persists the cache to disk across sessions. Everyday single-user desktop scenarios are unlikely to expose sensitive data through this path.

Root Cause

The root cause is missing enforcement of HTTP cache semantics. The cache lookup logic keys entries on request URI without secondary matching on the request headers named in the stored response's Vary header. As a result, cache hits are computed without the required equivalence check on varying request dimensions.

Attack Vector

An attacker positioned to trigger requests through a shared libsoup-backed cache can induce the cache to serve responses intended for another user or context. For example, a first request authenticated as User A populates the cache with private data; a subsequent unauthenticated request for the same URI receives User A's cached response. The attack is network-adjacent, requires no privileges, and no user interaction, but demands specific caching conditions to succeed.

See the Red Hat CVE-2025-9901 Advisory and the upstream GNOME libsoup Issue #453 for technical details.

Detection Methods for CVE-2025-9901

Indicators of Compromise

Application logs showing identical HTTP response bodies returned to requests carrying different Authorization, Cookie, or Accept-Language headers.
Unexpected language, locale, or user context appearing in rendered content served through libsoup-based clients.
Presence of vulnerable libsoup versions on shared hosts or proxy systems inventoried by asset management.

Detection Strategies

Inventory installed libsoup packages across Linux endpoints and servers, and compare versions against vendor advisories.
Instrument applications that consume libsoup to log cache hits alongside request headers, and audit for Vary-violating reuse.
Correlate proxy or gateway logs with client identity to detect responses served to principals other than the original requester.

Monitoring Recommendations

Track package inventory changes for libsoup, libsoup-3, and related dependencies via endpoint telemetry.
Alert on deployments of applications embedding cached HTTP data intended for authenticated users in multi-tenant hosts.
Monitor advisories from Red Hat, GNOME, and downstream distributions for updated fixed versions.

How to Mitigate CVE-2025-9901

Immediate Actions Required

Identify systems running libsoup in proxy, kiosk, or multi-user configurations and prioritize them for patching.
Apply distribution updates for libsoup as soon as vendor packages become available.
Restart services and applications linking against libsoup after upgrading to ensure the patched library is loaded.

Patch Information

Refer to the Red Hat CVE-2025-9901 Advisory and the upstream GNOME libsoup Issue #453 for fix commits and package versions. Downstream distributions publish updated libsoup packages that add Vary header enforcement in SoupCache lookups. Track the Red Hat Bug Report #2392790 for backported fixes.

Workarounds

Disable SoupCache in applications where it is not required, forcing origin fetches instead of cache reuse.
Configure applications to store per-user cache directories rather than shared paths, limiting cross-principal exposure.
Restrict libsoup-backed HTTP clients from caching responses containing Authorization or Set-Cookie headers.

bash

# Example: verify installed libsoup version and remove shared cache directories
rpm -q libsoup libsoup3
find /var/cache -type d -name 'httpcache' -exec ls -ld {} \;
# After patching, clear stale cache entries created before the fix
rm -rf ~/.cache/*/httpcache/*