CVE-2025-14523

Published: Dec 11, 2025

Modified: Mar 19, 2026

PUBLISHED

CVSS v3.1

8.2

HIGH

Description

A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 10	unaffected `0:3.6.5-3.el10_1.8 - < *`
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	unaffected `0:3.6.5-3.el10_0.11 - < *`
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	unaffected `0:2.62.2-10.el7_9 - < *`
Red Hat	Red Hat Enterprise Linux 8	unaffected `0:2.62.3-11.el8_10 - < *`
Red Hat	Red Hat Enterprise Linux 8	unaffected `0:8.10-6.el8_10.1 - < *`
Red Hat	Red Hat Enterprise Linux 8	unaffected `0:2.62.3-11.el8_10 - < *`
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	unaffected `0:2.62.3-1.el8_2.7 - < *`
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	unaffected `0:8.10-6.el8_2.1 - < *`
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	unaffected `0:2.62.3-2.el8_4.7 - < *`
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	unaffected `0:8.10-6.el8_4.1 - < *`
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	unaffected `0:2.62.3-2.el8_4.7 - < *`
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	unaffected `0:8.10-6.el8_4.1 - < *`
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	unaffected `0:2.62.3-2.el8_6.7 - < *`
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	unaffected `0:8.10-6.el8_6.1 - < *`
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	unaffected `0:2.62.3-2.el8_6.7 - < *`
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	unaffected `0:8.10-6.el8_6.1 - < *`
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	unaffected `0:2.62.3-2.el8_6.7 - < *`
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	unaffected `0:8.10-6.el8_6.1 - < *`
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	unaffected `0:2.62.3-3.el8_8.7 - < *`
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	unaffected `0:8.10-6.el8_8.1 - < *`
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	unaffected `0:2.62.3-3.el8_8.7 - < *`
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	unaffected `0:8.10-6.el8_8.1 - < *`
Red Hat	Red Hat Enterprise Linux 9	unaffected `0:2.72.0-12.el9_7.3 - < *`
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	unaffected `0:2.72.0-8.el9_0.8 - < *`
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	unaffected `0:2.72.0-8.el9_2.8 - < *`
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	unaffected `0:2.72.0-8.el9_4.8 - < *`
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	unaffected `0:2.72.0-10.el9_6.5 - < *`
Red Hat	Red Hat Enterprise Linux 6	All versions