CVE-2025-46421
Rocky Linux vulnerability analysis and mitigation

Overview

A security vulnerability (CVE-2025-46421) was discovered in libsoup, affecting versions prior to 3.6.5. The vulnerability was disclosed on April 24, 2025, and involves an authentication information disclosure issue when handling HTTP redirects. The flaw affects libsoup clients, which is a HTTP client/server library for GNOME applications (NVD, Red Hat Bugzilla).

Technical details

The vulnerability occurs when libsoup clients encounter an HTTP redirect. The client mistakenly sends the HTTP Authorization header to the new host that the redirection points to, instead of properly managing the authentication credentials. This implementation flaw has been assigned a CVSS v3.1 Base Score of 6.8 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N (NVD).

Impact

The vulnerability allows the new host to impersonate the user to the original host that issued the redirect. This can lead to unauthorized access and potential credential theft, as the redirected host receives authentication credentials intended for the original host (NVD, Red Hat Bugzilla).

Exploitability

The vulnerability requires network access and can be exploited when a malicious server issues a redirect to capture authentication credentials. The attack complexity is considered high, requires no privileges, but does need user interaction, as indicated by the CVSS metrics (NVD).

Mitigation and workarounds

The vulnerability has been fixed in libsoup version 3.6.5. Users and organizations using affected versions of libsoup should upgrade to the patched version to prevent potential exploitation (Red Hat Bugzilla).

Additional resources

Linux Distribution fix status

Fix availability across major Linux distributions and their releases.

Debian

Affected

bookworm

libsoup3: 3.2.3-0+deb12u1

Fixed

sid

libsoup3: 3.6.5-1

Fixed

trixie

libsoup3: 3.6.5-1

Fixed

Ubuntu

Fixed

bionic (esm-infra)

libsoup2.4: 2.62.1-1ubuntu0.4+esm2

Fixed

devel

libsoup2.4: 2.74.3-10.1ubuntu1

Fixed

focal

libsoup2.4: 2.70.0-1ubuntu0.3

Fixed

focal (esm-infra)

libsoup2.4: 2.70.0-1ubuntu0.3

Fixed

jammy

libsoup3

Affected

jammy (esm-apps)

libsoup3: 3.0.7-0ubuntu1+esm3

Fixed

noble

libsoup2.4: 2.74.3-6ubuntu1.3

Fixed

questing

libsoup2.4: 2.74.3-10.1ubuntu1

Fixed

RHEL / CentOS

Fixed

RHEL 8

:appstream:libsoup-0:2.62.3-8.el8_10.src

Fixed

RHEL 9

:appstream:libsoup-0:2.72.0-8.el9_0.4.src

Fixed

RHEL 10

libsoup3-0:3.6.5-3.el10_0.src

Fixed

SourceThis report was generated using AI

Related Rocky Linux vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-44950CRITICAL9.5
  • Rocky Linux logoRocky Linux
  • libXfont2.src
NoYesSep 10, 2026
CVE-2026-59679CRITICAL9.2
  • Rocky Linux logoRocky Linux
  • libXfont-devel
NoYesSep 10, 2026
CVE-2026-75092HIGH7.3
  • Rocky Linux logoRocky Linux
  • leapp-upgrade-el9toel10-fapolicyd
NoYesSep 15, 2026
CVE-2026-69806HIGH7
  • Visual Studio 2022 logoVisual Studio 2022
  • dotnet-apphost-pack-10.0
NoYesSep 08, 2026
CVE-2026-58649MEDIUM6.5
  • Visual Studio 2022 logoVisual Studio 2022
  • aspnetcore-runtime-dbg-10.0
NoYesSep 08, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management