CVE-2025-14523

Summary

A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Enterprise Linux 100:3.6.5-3.el10_1.8 < *unaffected
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support0:3.6.5-3.el10_0.11 < *unaffected
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support0:2.62.2-10.el7_9 < *unaffected
Red HatRed Hat Enterprise Linux 80:2.62.3-11.el8_10 < *unaffected
Red HatRed Hat Enterprise Linux 80:8.10-6.el8_10.1 < *unaffected
Red HatRed Hat Enterprise Linux 80:2.62.3-11.el8_10 < *unaffected
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support0:2.62.3-1.el8_2.7 < *unaffected
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support0:8.10-6.el8_2.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support0:2.62.3-2.el8_4.7 < *unaffected
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support0:8.10-6.el8_4.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On0:2.62.3-2.el8_4.7 < *unaffected
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On0:8.10-6.el8_4.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support0:2.62.3-2.el8_6.7 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support0:8.10-6.el8_6.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service0:2.62.3-2.el8_6.7 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service0:8.10-6.el8_6.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions0:2.62.3-2.el8_6.7 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions0:8.10-6.el8_6.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service0:2.62.3-3.el8_8.7 < *unaffected
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service0:8.10-6.el8_8.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions0:2.62.3-3.el8_8.7 < *unaffected
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions0:8.10-6.el8_8.1 < *unaffected
Red HatRed Hat Enterprise Linux 90:2.72.0-12.el9_7.3 < *unaffected
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions0:2.72.0-8.el9_0.8 < *unaffected
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions0:2.72.0-8.el9_2.8 < *unaffected
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support0:2.72.0-8.el9_4.8 < *unaffected
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support0:2.72.0-10.el9_6.5 < *unaffected

Weaknesses

  • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Workarounds

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References