Security readout for executives and security teams
Plain-English summary
Libsoup can reuse a cached web response when it should keep responses separate by request headers. In shared or proxy-like use, one user could receive content meant for another request, creating a confidentiality risk. The sources say everyday desktop use is unlikely to be affected.
Executive priority
Handle as a targeted confidentiality risk, not a broad emergency. Prioritize internet-facing, proxy-like, or multi-user services using libsoup caching before ordinary desktop fleets.
Technical view
SoupCache ignores the HTTP Vary header when evaluating cached responses. Vary should distinguish cached objects by headers such as language or authentication. The reported impact is confidentiality exposure only, with CVSS 3.1 score 5.9 and CWE-524 classification.
Likely exposure
Most relevant exposure is RHEL systems running applications or services that use libsoup or libsoup3 SoupCache in proxy, shared-cache, or multi-user contexts. Red Hat lists RHEL 7, 8, 9, and 10 as affected; RHEL 6 status is unknown.
Exploitation context
The bundle does not show KEV listing or active exploitation. Practical abuse appears context-dependent and higher-complexity, requiring cache reuse across requests where headers should produce separate responses, especially around authentication or other sensitive variations.
Researcher notes
Evidence supports the root cause and affected Red Hat product families, but not exploit activity or fixed versions. Validation should focus on whether SoupCache is used where Vary separates sensitive responses.
Mitigation direction
- Check Red Hat and GNOME guidance for fixed package availability.
- Prioritize RHEL 7, 8, 9, and 10 systems using libsoup caching.
- Avoid shared SoupCache use for authenticated or user-specific responses.
- Segregate caches per user, tenant, or security context where possible.
- Treat RHEL 6 exposure as unknown until vendor guidance clarifies status.
Validation and detection
- Inventory installed libsoup and libsoup3 packages on RHEL systems.
- Identify applications or services that enable SoupCache.
- Check whether caches are shared across users, sessions, or tenants.
- Review whether cached responses vary by Authorization, Cookie, or language headers.
- Track Red Hat advisory status for fixed builds or backports.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-524: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-9901 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N2.23.6redhatVulnerability scoring details
Base CVSS 3.1 score
5.9MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Made public.
- Source timelineredhat
Reported to Red Hat.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://access.redhat.com/security/cve/CVE-2025-9901CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2392790CVE reference, redhat · issue-tracking, x_refsource_REDHAT
- https://gitlab.gnome.org/GNOME/libsoup/-/issues/453CVE reference, redhat
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Cache Containing Sensitive Information
Use of Cache Containing Sensitive Information represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.