CVE catalog

CVE-2025-46421

libsoup vulnerabilities

Severity: Medium · CVSS 6.8CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Published: Apr 24, 2025, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.58% · Oct 27, 2026

A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libsoup3	sid	`3.8.0-3`	fixed
Debian	libsoup3	forky	`3.8.0-3`	fixed
Debian	libsoup3	trixie	`3.6.5-3`	fixed
Debian	libsoup3	bookworm	`3.2.3-0+deb12u2`	fixed
Debian	libsoup2.4	trixie	`2.74.3-10.1`	vulnerable
Debian	libsoup2.4	bookworm	`2.74.3-1+deb12u1`	vulnerable
Ubuntu	libsoup2.4	noble	Not reported	vulnerable
Ubuntu	libsoup3	noble	`3.2.3-0+deb12u1`	fixed
Ubuntu	libsoup3	noble	`3.4.4-5ubuntu0.3`	fixed
Ubuntu	gir1.2-soup-3.0	noble	`3.4.4-5ubuntu0.3`	fixed
Ubuntu	libsoup-3.0-0	noble	`3.4.4-5ubuntu0.3`	fixed
Ubuntu	libsoup-3.0-common	noble	`3.4.4-5ubuntu0.3`	fixed
Ubuntu	libsoup-3.0-dev	noble	`3.4.4-5ubuntu0.3`	fixed
Ubuntu	libsoup-3.0-doc	noble	`3.4.4-5ubuntu0.3`	fixed
Ubuntu	libsoup-3.0-tests	noble	`3.4.4-5ubuntu0.3`	fixed
Ubuntu	libsoup2.4	noble	`2.74.3-6ubuntu1.3`	fixed
Ubuntu	gir1.2-soup-2.4	noble	`2.74.3-6ubuntu1.3`	fixed
Ubuntu	libsoup-2.4-1	noble	`2.74.3-6ubuntu1.3`	fixed
Ubuntu	libsoup-gnome-2.4-1	noble	`2.74.3-6ubuntu1.3`	fixed
Ubuntu	libsoup-gnome2.4-dev	noble	`2.74.3-6ubuntu1.3`	fixed
Ubuntu	libsoup2.4-common	noble	`2.74.3-6ubuntu1.3`	fixed
Ubuntu	libsoup2.4-dev	noble	`2.74.3-6ubuntu1.3`	fixed
Ubuntu	libsoup2.4-doc	noble	`2.74.3-6ubuntu1.3`	fixed
Ubuntu	libsoup2.4-tests	noble	`2.74.3-6ubuntu1.3`	fixed
Ubuntu	libsoup2.4	pro	`2.60.1-1`	vulnerable
Ubuntu	libsoup2.4	pro	`2.60.2-1`	vulnerable
Ubuntu	libsoup2.4	pro	`2.60.2-2`	vulnerable
Ubuntu	libsoup2.4	pro	`2.60.3-1`	vulnerable
Ubuntu	libsoup2.4	pro	`2.61.90-1`	vulnerable
Ubuntu	libsoup2.4	pro	`2.62.0-1`	vulnerable
Ubuntu	libsoup2.4	pro	`2.62.1-1`	vulnerable
Ubuntu	libsoup2.4	pro	`2.62.1-1ubuntu0.1`	vulnerable
Ubuntu	libsoup2.4	pro	`2.62.1-1ubuntu0.3`	vulnerable
Ubuntu	libsoup2.4	pro	`2.62.1-1ubuntu0.4`	vulnerable
Ubuntu	libsoup2.4	pro	`2.62.1-1ubuntu0.4+esm1`	vulnerable
Ubuntu	libsoup2.4	pro	`2.62.1-1ubuntu0.4+esm2`	fixed
Ubuntu	libsoup2.4	20.04	`2.68.2-0ubuntu1`	vulnerable
Ubuntu	libsoup2.4	20.04	`2.68.2-1`	vulnerable
Ubuntu	libsoup2.4	20.04	`2.68.2-2`	vulnerable
Ubuntu	libsoup2.4	20.04	`2.68.2-2build2`	vulnerable
Ubuntu	libsoup2.4	20.04	`2.69.90-1`	vulnerable
Ubuntu	libsoup2.4	20.04	`2.70.0-1`	vulnerable
Ubuntu	libsoup2.4	20.04	`2.70.0-1ubuntu0.1`	vulnerable
Ubuntu	libsoup2.4	20.04	`2.70.0-1ubuntu0.2`	vulnerable
Ubuntu	libsoup2.4	20.04	`2.70.0-1ubuntu0.3`	fixed
Ubuntu	libsoup2.4	22.04	`2.72.0-3ubuntu3`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.1-1`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-2`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.1`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.2`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.3`	fixed
Ubuntu	libsoup3	pro	`3.0.4-2`	vulnerable
Ubuntu	libsoup3	pro	`3.0.4-3`	vulnerable
Ubuntu	libsoup3	pro	`3.0.5-1`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm1`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm2`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm3`	fixed
Ubuntu	libsoup2.4	24.04	`2.74.3-1`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-2`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-3`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6build1`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.1`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.2`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.3`	fixed
Ubuntu	libsoup3	24.04	`3.4.2-4`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-1`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-2`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-4`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5build1`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5build2`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.1`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.2`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.3`	fixed
Ubuntu	libsoup2.4	25.10	`2.74.3-10`	vulnerable
Ubuntu	libsoup2.4	25.10	`2.74.3-10.1`	vulnerable
Ubuntu	libsoup2.4	25.10	`2.74.3-10.1ubuntu1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libsoup3	source	sid	`3.6.5-1`	not yet assigned	Not reported	Not reported
Debian	libsoup3	source	forky	`3.6.5-1`	not yet assigned	Not reported	Not reported
Debian	libsoup3	source	trixie	`3.6.5-1`	not yet assigned	Not reported	Not reported
Debian	libsoup3	source	bookworm	`3.2.3-0+deb12u1`	not yet assigned	Not reported	Not reported
Debian	libsoup2.4	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1104054]
Debian	libsoup2.4	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1104054]
Ubuntu	libsoup3	deb	noble	`3.2.3-0+deb12u1`	Not reported	Not reported	Not reported
Ubuntu	libsoup3	deb	noble	`3.4.4-5ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	gir1.2-soup-3.0	deb	noble	`3.4.4-5ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	libsoup-3.0-0	deb	noble	`3.4.4-5ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	libsoup-3.0-common	deb	noble	`3.4.4-5ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	libsoup-3.0-dev	deb	noble	`3.4.4-5ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	libsoup-3.0-doc	deb	noble	`3.4.4-5ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	libsoup-3.0-tests	deb	noble	`3.4.4-5ubuntu0.3`	Not reported	Not reported	Not reported
Ubuntu	libsoup2.4	deb	noble	`2.74.3-6ubuntu1.3`	Not reported	Not reported	Not reported
Ubuntu	gir1.2-soup-2.4	deb	noble	`2.74.3-6ubuntu1.3`	Not reported	Not reported	Not reported
Ubuntu	libsoup-2.4-1	deb	noble	`2.74.3-6ubuntu1.3`	Not reported	Not reported	Not reported
Ubuntu	libsoup-gnome-2.4-1	deb	noble	`2.74.3-6ubuntu1.3`	Not reported	Not reported	Not reported
Ubuntu	libsoup-gnome2.4-dev	deb	noble	`2.74.3-6ubuntu1.3`	Not reported	Not reported	Not reported
Ubuntu	libsoup2.4-common	deb	noble	`2.74.3-6ubuntu1.3`	Not reported	Not reported	Not reported
Ubuntu	libsoup2.4-dev	deb	noble	`2.74.3-6ubuntu1.3`	Not reported	Not reported	Not reported
Ubuntu	libsoup2.4-doc	deb	noble	`2.74.3-6ubuntu1.3`	Not reported	Not reported	Not reported
Ubuntu	libsoup2.4-tests	deb	noble	`2.74.3-6ubuntu1.3`	Not reported	Not reported	Not reported
Ubuntu	libsoup2.4	deb	pro	`2.62.1-1ubuntu0.4+esm2`	Not reported	UBUNTU-CVE-2025-46421	Not reported
Ubuntu	libsoup2.4	deb	20.04	`2.70.0-1ubuntu0.3`	Not reported	UBUNTU-CVE-2025-46421	Not reported
Ubuntu	libsoup2.4	deb	22.04	`2.74.2-3ubuntu0.3`	Not reported	UBUNTU-CVE-2025-46421	Not reported
Ubuntu	libsoup3	deb	pro	`3.0.7-0ubuntu1+esm3`	Not reported	UBUNTU-CVE-2025-46421	Not reported
Ubuntu	libsoup2.4	deb	24.04	`2.74.3-6ubuntu1.3`	Not reported	UBUNTU-CVE-2025-46421	Not reported
Ubuntu	libsoup3	deb	24.04	`3.4.4-5ubuntu0.3`	Not reported	UBUNTU-CVE-2025-46421	Not reported
Ubuntu	libsoup2.4	deb	25.10	`2.74.3-10.1ubuntu1`	Not reported	UBUNTU-CVE-2025-46421	Not reported

[Debian bug #1104054]

Notes

[trixie] libsoup2.4: Minor issue [bookworm] libsoup2.4: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[gir1.2-soup-2.4]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
[libsoup2.4-1]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
[libsoup2.4-common]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · all · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · all · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
[libsoup2.4-dev]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
[libsoup2.4-doc]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · all · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · all · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
[libsoup2.4-tests]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
[libsoup-gnome2.4-1]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
[libsoup-gnome2.4-dev]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
[gir1.2-soup-3.0]Fixed
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 3.2.3-0+deb12u1
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 3.2.3-0+deb12u1
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
[libsoup-3.0-0]Fixed
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 3.2.3-0+deb12u1
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 3.2.3-0+deb12u1
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
[libsoup-3.0-common]Fixed
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · all · bookworm
  Fixed · Fixed: 3.2.3-0+deb12u1
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · all · bookworm
  Fixed · Fixed: 3.2.3-0+deb12u1
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
[libsoup-3.0-dev]Fixed
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 3.2.3-0+deb12u1
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 3.2.3-0+deb12u1
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

[Debian 13 (Trixie)]

[gir1.2-soup-2.4]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · amd64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13
- 2.74.3-10.1 · arm64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13
[libsoup-2.4-1]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · amd64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13
- 2.74.3-10.1 · arm64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13
[libsoup2.4-common]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · all · trixie
  Affected
  usn · libsoup2.4 · debian · 13
- 2.74.3-10.1 · all · trixie
  Affected
  usn · libsoup2.4 · debian · 13
[libsoup2.4-dev]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · amd64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13
- 2.74.3-10.1 · arm64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13
[libsoup2.4-doc]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · all · trixie
  Affected
  usn · libsoup2.4 · debian · 13
- 2.74.3-10.1 · all · trixie
  Affected
  usn · libsoup2.4 · debian · 13
[libsoup2.4-tests]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · amd64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13
- 2.74.3-10.1 · arm64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13
[libsoup-gnome-2.4-1]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · amd64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13
- 2.74.3-10.1 · arm64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13
[libsoup-gnome2.4-dev]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · amd64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13
- 2.74.3-10.1 · arm64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13

Next results

Observed: Oct 24, 2026, 10:51:42 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]