CVE-2025-14523: 
Rocky Linux vulnerability analysis and mitigation

CVE-2025-14523 is a duplicate Host header handling vulnerability in libsoup (GNOME's HTTP client/server library) that enables HTTP request smuggling-style attacks, cache poisoning, and bypass of host-based access controls. The flaw arises because libsoup implements a "last-value-wins" policy when processing multiple Host: headers, while most front-end proxies honor the first Host: header — creating a routing discrepancy exploitable by unauthenticated remote attackers. It was disclosed on December 11, 2025, and affects libsoup as shipped across multiple Linux distributions including RHEL 7 through 10, Oracle Solaris 11.4, and IBM Netezza Appliance. The CVSS v3.1 base score is 8.2 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). When libsoup's soup_message_headers_get_one[_common] function is used to construct the request URI, it returns the last occurrence of the Host: header, whereas common reverse proxies and load balancers typically route based on the first Host: header. An attacker can craft an HTTP request containing two Host: headers — one targeting a legitimate backend (used by the proxy for routing) and a second targeting a different virtual host (used by the libsoup backend for processing) — causing a vhost confusion condition. No authentication or user interaction is required, and the attack is executable over the network with low complexity (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation can allow an attacker to bypass host-based access controls (e.g., ACLs enforced per virtual host), perform cache poisoning by causing shared caches to store responses associated with the wrong host, and conduct request-smuggling style attacks that manipulate routing between proxies and backend servers. The confidentiality impact is rated Low (potential exposure of information from unintended virtual hosts), while the integrity impact is rated High due to the ability to manipulate request routing and poison caches. Availability is not directly impacted. Systems running libsoup behind a reverse proxy or load balancer in multi-tenant or virtual-host configurations are most at risk (Red Hat CVE, Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.028% (0.000280), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The bug report notes that a PoC was used internally to demonstrate the vhost confusion behavior reliably (Red Hat Bugzilla, Red Hat CVE).

1. Reconnaissance: Identify targets running applications that use libsoup as an HTTP server library and are deployed behind a reverse proxy or load balancer (e.g., nginx, HAProxy, Varnish) in a virtual-host configuration.
2. Craft malicious request: Construct an HTTP request containing two Host: headers — the first set to the legitimate target virtual host (e.g., Host: legitimate-host.example.com) and the second set to the attacker's desired target virtual host (e.g., Host: internal-admin.example.com).
3. Send request through proxy: Transmit the crafted request to the front-end proxy. The proxy reads the first Host: header and routes the request to the backend serving legitimate-host.example.com.
4. Exploit libsoup's last-value-wins behavior: The libsoup backend processes the request using the last Host: header (internal-admin.example.com), causing it to interpret the request as destined for a different virtual host than the proxy intended.
5. Achieve objective: Depending on the deployment, the attacker may bypass host-based ACLs (gaining access to restricted virtual hosts), poison shared caches with responses attributed to the wrong host, or manipulate application logic that relies on the Host: header for routing decisions (Red Hat Bugzilla, Red Hat CVE).

• Network: HTTP requests containing multiple Host: headers in a single request, particularly where the two values differ (e.g., one pointing to a public host and one to an internal or restricted host); unusual cross-vhost traffic patterns in proxy access logs.
• Logs: Web server or application logs showing requests attributed to unexpected virtual hosts that do not match the proxy's routing decision; discrepancies between the Host: value logged by the proxy and the value logged by the libsoup backend.
• Application Behavior: Unexpected cache entries associated with incorrect virtual hosts; access to host-restricted resources from clients that should not have been routed to those backends.

Red Hat has released patched libsoup packages across all affected RHEL versions via multiple security advisories issued in January 2026, including RHSA-2026:0421 (RHEL 8, libsoup-2.62.3-11.el8_10), RHSA-2026:0422 (RHEL 9, libsoup-2.72.0-12.el9_7.3), and RHSA-2026:0423 (RHEL 10), among others for extended support variants (Red Hat RHSA-2026:0421, Red Hat RHSA-2026:0422). Oracle has addressed the issue in Oracle Solaris 11.4 via the January 2026 Third Party Bulletin (Oracle Bulletin). IBM has released a fix for affected Netezza Appliance versions (IBM Advisory). As a configuration-level workaround, administrators should configure front-end proxies to reject or normalize requests containing duplicate Host: headers before forwarding them to libsoup backends, and implement strict header validation at the proxy layer. Upgrading to a patched libsoup version is the recommended long-term remediation.

Red Hat rated this vulnerability as Important severity and issued a broad set of security advisories covering RHEL 7 through 10 and various extended support variants, reflecting the wide deployment of libsoup across enterprise Linux environments (Red Hat RHSA-2026:0421). The vulnerability received coverage from Linux security news aggregators and distribution security teams including SUSE, Oracle, Rocky Linux, AlmaLinux, Amazon Linux, and Fedora, all of which issued their own advisories. Community reaction has been measured, with no significant controversy or high-profile researcher commentary identified beyond standard vulnerability disclosure channels.