CVE-2025-4945

Published: May 19, 2025

Modified: Mar 19, 2026

PUBLISHED

CVSS v3.1

3.7

LOW

Description

A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior. The issue stems from improper validation of large integer inputs during date arithmetic operations within the cookie parsing routines.

Vendor	Product	Versions
Unknown	libsoup	affected `0 - <= 3.6.5`
Red Hat	Red Hat Enterprise Linux 10	unaffected `0:3.6.5-3.el10_0.9 - < *`
Red Hat	Red Hat Enterprise Linux 10	unaffected `0:3.6.5-3.el10_1.6 - < *`
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	unaffected `0:2.62.2-9.el7_9 - < *`
Red Hat	Red Hat Enterprise Linux 8	unaffected `0:2.62.3-10.el8_10 - < *`
Red Hat	Red Hat Enterprise Linux 8	unaffected `0:2.62.3-10.el8_10 - < *`
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	unaffected `0:2.62.3-1.el8_2.6 - < *`
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	unaffected `0:2.62.3-2.el8_4.6 - < *`
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	unaffected `0:2.62.3-2.el8_4.6 - < *`
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	unaffected `0:2.62.3-2.el8_6.6 - < *`
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	unaffected `0:2.62.3-2.el8_6.6 - < *`
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	unaffected `0:2.62.3-2.el8_6.6 - < *`
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	unaffected `0:2.62.3-3.el8_8.6 - < *`
Red Hat	Red Hat Enterprise Linux 9	unaffected `0:2.72.0-10.el9_6.3 - < *`
Red Hat	Red Hat Enterprise Linux 9	unaffected `0:2.72.0-12.el9_7.1 - < *`
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	unaffected `0:2.72.0-8.el9_0.6 - < *`
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	unaffected `0:2.72.0-8.el9_2.6 - < *`
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	unaffected `0:2.72.0-8.el9_4.6 - < *`
Red Hat	Red Hat Enterprise Linux 6	All versions