VDB
DEBIAN-CVE-2025-46421
DEBIAN-CVE-2025-46421
PUBLISHED
CVSS 6.800000190734863 MEDIUM
A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.
Risk Scores
CVSS 3.1
6.800000190734863
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | libsoup2.4 | 2.74.3-11, 2.74.3-10.1, 0 |
| Debian:11 | libsoup2.4 | 2.72.0-2+deb11u3, 2.72.0-3, 2.72.0-4 |
| Debian:12 | libsoup3 | 3.2.2-2, 0, 3.2.2-2 |
| Debian:13 | libsoup3 | 0, 0 |
| Debian:14 | libsoup3 | 0, 0 |
| Debian:12 | libsoup2.4 | 2.74.3-3.1~exp2, 2.74.3-3.1~exp3, 2.74.3-5 |
Timeline
- Apr 24, 2025 CVE Published
- Apr 28, 2026 CVE Updated