Introduction
CVE-2025-11021 is a high-severity vulnerability in libsoup, the HTTP library that GNOME and many Linux-based applications are built on. An attacker can use a crafted cookie expiration date to trigger an out-of-bounds memory read. A read like this can leak sensitive information from memory, with direct consequences for user privacy and application security.
libsoup is a widely used HTTP client and server library maintained by the GNOME Foundation. It handles web communication in the GNOME desktop environment, and many open-source and commercial applications across Linux distributions depend on it. Because so much software uses it, a vulnerability in libsoup can spread across the Linux ecosystem.
Technical information
CVE-2025-11021 is classified as an out-of-bounds read (CWE-125) in libsoup's cookie date handling. When libsoup processes an HTTP response that contains a Set-Cookie header, it parses the expiration date to decide whether the cookie is valid. The parser does not adequately check the length or format of the expiration date string before it processes it. An attacker who controls an HTTP server, or who can inject responses, can send a Set-Cookie header with a specially crafted expiration date. The malformed value makes libsoup read memory beyond the allocated buffer, which may disclose sensitive data from the process memory space.
The attack needs only a vulnerable libsoup-based client to process a malicious HTTP response. It requires no user interaction and no special privileges. That makes the flaw a particular concern for desktop environments and for applications that regularly talk to untrusted web servers.
No code snippets or proof of concept for this vulnerability had been made public as of the publication date.
Affected systems and versions
According to the available information, the vulnerability affects libsoup as used in GNOME and other Linux-based applications. The public sources do not list the specific affected versions. Until vendor advisories say otherwise, organizations should assume that every currently supported version of libsoup in the major Linux distributions may be affected.
Vendor security history
libsoup has had several memory safety vulnerabilities in recent years, including:
- CVE-2025-2784: Heap buffer over-read in content sniffing
- CVE-2025-32914: Out-of-bounds read in multipart message processing
Major vendors such as Red Hat, Ubuntu, and SUSE typically ship patches within days to weeks of disclosure. Even so, the number of memory management bugs found in libsoup points to ongoing problems with secure coding practices in the library.
