CVE-2025-11021 | BDVDB-2026-295639 Detail
Red HatRed Hat Enterprise Linux 10
Description#
A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw could result in unintended disclosure of memory contents, potentially exposing sensitive information from the process using libsoup.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-125 Out-of-bounds Read
References#
- https://access.redhat.com/errata/RHSA-2025:18183
- https://access.redhat.com/errata/RHSA-2025:19713
- https://access.redhat.com/errata/RHSA-2025:19714
- https://access.redhat.com/errata/RHSA-2025:20959
- https://access.redhat.com/errata/RHSA-2025:21032
- https://access.redhat.com/errata/RHSA-2025:21655
- https://access.redhat.com/errata/RHSA-2025:21656
- https://access.redhat.com/errata/RHSA-2025:21657
- https://access.redhat.com/errata/RHSA-2025:21664
- https://access.redhat.com/errata/RHSA-2025:21665
- https://access.redhat.com/errata/RHSA-2025:21666
- https://access.redhat.com/errata/RHSA-2025:21772
- https://access.redhat.com/errata/RHSA-2025:22013
- https://access.redhat.com/security/cve/CVE-2025-11021
- https://bugzilla.redhat.com/show_bug.cgi?id=2399627
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.