Medium
Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server
Type: advisorySources: OSV
A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-46421
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 23:48 UTC · Revision 1
Source evidence
Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server
core-osv · Original sourcePublished 24 Apr 2025, 13:01 UTC
A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.
osv:CVE-2025-46421
Complete source record
{
"id": "248d77a2a1285ed0b08ee64d5ee4ab9344ede4beaa2946ad84a1cd424aefec76",
"url": "https://osv.dev/vulnerability/CVE-2025-46421",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server",
"summary": "A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.",
"evidence": "osv:CVE-2025-46421",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2025-46421",
"aliases": [
"CVE-2025-46421"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://gitlab.gnome.org/gnome/libsoup",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "766e17528251c9b696a6076300ac61adc95536ac"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "3.6.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
}
],
"versions": [
"2.72.0",
"3.6.4",
"3.6.3",
"3.6.2",
"3.6.1",
"3.4.4",
"3.6.0",
"3.5.2",
"3.5.1",
"3.4.3",
"3.4.2",
"3.4.1",
"3.4.0",
"3.3.1",
"3.3.0",
"3.2.0",
"3.1.4",
"3.1.3",
"3.1.2",
"3.1.1",
"3.0.6",
"3.0.5",
"3.0.4",
"3.0.3",
"3.0.2",
"3.0.1",
"3.0.0",
"2.99.9",
"2.99.8",
"2.99.7",
"2.99.6",
"2.99.5",
"2.99.4",
"2.99.3",
"2.99.2",
"2.99.1",
"2.71.1",
"2.71.0",
"2.70.0",
"2.69.90",
"2.68.3",
"2.68.2",
"2.68.1",
"2.68.0",
"2.67.93",
"2.67.92",
"2.67.91",
"2.67.90",
"2.67.3",
"2.67.2",
"2.67.1",
"2.66.2",
"2.66.1",
"2.66.0",
"2.65.92",
"2.65.91",
"2.65.90",
"2.65.2",
"2.65.1",
"2.64.0",
"2.63.92",
"2.63.91",
"2.63.90",
"2.63.2",
"2.63.1",
"2.62.0",
"2.61.91",
"2.61.90",
"2.61.2",
"2.61.1",
"2.60.2",
"2.60.1",
"2.60.0",
"2.59.90.1",
"2.59.90",
"2.58.0",
"2.57.1",
"2.56.0",
"2.55.90",
"2.54.1",
"2.54.0.1",
"2.54.0",
"2.53.92",
"2.53.90",
"2.53.2",
"2.53.1",
"2.52.1",
"2.52.0",
"2.51.92",
"2.51.90",
"2.51.3",
"2.50.0",
"2.49.92",
"2.49.91.1",
"2.49.91",
"2.49.1",
"2.48.0",
"2.47.92",
"2.47.4",
"2.47.3",
"2.46.0",
"2.45.92",
"2.45.90",
"2.45.3",
"2.44.1",
"2.44.0",
"LIBSOUP_2_43_92",
"2.43.92",
"LIBSOUP_2_43_90",
"2.43.90",
"LIBSOUP_2_43_5",
"2.43.5",
"LIBSOUP_2_43_4",
"2.43.4",
"LIBSOUP_2_43_2",
"2.43.2",
"LIBSOUP_2_43_1",
"2.43.1",
"LIBSOUP_2_42_1",
"2.42.1",
"LIBSOUP_2_42_0",
"2.42.0",
"LIBSOUP_2_41_92",
"2.41.92",
"LIBSOUP_2_41_91",
"2.41.91",
"LIBSOUP_2_41_90",
"2.41.90",
"LIBSOUP_2_41_5",
"2.41.5",
"LIBSOUP_2_41_4",
"2.41.4",
"LIBSOUP_2_41_3",
"2.41.3",
"LIBSOUP_2_41_2",
"2.41.2",
"LIBSOUP_2_41_1",
"2.41.1",
"LIBSOUP_2_40_1",
"2.40.1",
"LIBSOUP_2_40_0",
"2.40.0",
"LIBSOUP_2_39_92",
"LIBSOUP_2_39_91",
"LIBSOUP_2_39_90",
"LIBSOUP_2_39_5",
"LIBSOUP_2_38_1",
"LIBSOUP_2_39_4_1",
"LIBSOUP_2_39_4",
"LIBSOUP_2_39_3",
"LIBSOUP_2_39_2",
"LIBSOUP_2_39_1",
"LIBSOUP_2_38_0",
"LIBSOUP_2_37_92",
"LIBSOUP_2_37_91",
"LIBSOUP_2_37_90",
"LIBSOUP_2_37_5",
"LIBSOUP_2_37_4",
"LIBSOUP_2_37_3",
"LIBSOUP_2_37_2",
"LIBSOUP_2_37_1",
"LIBSOUP_2_36_0",
"LIBSOUP_2_35_92",
"LIBSOUP_2_35_90",
"LIBSOUP_2_35_4",
"LIBSOUP_2_35_3",
"LIBSOUP_2_34_1",
"LIBSOUP_2_34_0",
"LIBSOUP_2_33_92",
"LIBSOUP_2_33_90",
"LIBSOUP_2_33_6",
"LIBSOUP_2_33_5",
"LIBSOUP_2_33_4",
"LIBSOUP_2_32_2",
"LIBSOUP_2_32_1",
"LIBSOUP_2_32_0",
"LIBSOUP_2_31_92",
"LIBSOUP_2_31_90",
"LIBSOUP_2_31_6",
"LIBSOUP_2_30_0",
"LIBSOUP_2_29_91",
"LIBSOUP_2_29_90",
"LIBSOUP_2_29_6",
"LIBSOUP_2_29_5",
"LIBSOUP_2_29_3",
"LIBSOUP_2_28_1",
"LIBSOUP_2_28_0",
"LIBSOUP_2_27_92",
"LIBSOUP_2_27_91",
"LIBSOUP_2_27_90",
"LIBSOUP_2_27_5",
"LIBSOUP_2_27_4",
"LIBSOUP_2_27_2",
"LIBSOUP_2_27_1",
"LIBSOUP_2_26_1",
"LIBSOUP_2_26_0_9",
"LIBSOUP_2_26_0",
"LIBSOUP_2_25_91",
"LIBSOUP_2_25_5",
"LIBSOUP_2_25_4",
"LIBSOUP_2_25_2",
"LIBSOUP_2_25_1",
"LIBSOUP_2_24_0",
"LIBSOUP_2_23_92",
"LIBSOUP_2_23_91",
"LIBSOUP_2_23_6",
"LIBSOUP_2_23_1",
"LIBSOUP_2_4_1",
"LIBSOUP_2_4_0",
"LIBSOUP_2_3_4",
"LIBSOUP_2_3_2",
"LIBSOUP_2_3_0_1",
"LIBSOUP_2_2_103",
"LIBSOUP_2_2_102",
"LIBSOUP_2_2_101",
"SOUP_2_2_100",
"LIBSOUP_2_2_100",
"LIBSOUP_2_2_99",
"LIBSOUP_2_2_98",
"LIBSOUP_2_2_97",
"LIBSOUP_2_2_96",
"LIBSOUP_2_2_95_1",
"LIBSOUP_2_2_94",
"LIBSOUP_2_2_93",
"LIBSOUP_2_2_92",
"LIBSOUP_2_2_91",
"LIBSOUP_2_2_90_NOT_A_REAL_RELEASE",
"gnome-2-12-base",
"libsoup-pre214-branch-base",
"LIBSOUP_2_2_6_1",
"LIBSOUP_2_2_6",
"LIBSOUP_2_2_5",
"LIBSOUP_2_2_0",
"LIBSOUP_2_1_13",
"LIBSOUP_2_1_12",
"LIBSOUP_2_1_11",
"LIBSOUP_2_1_10",
"LIBSOUP_2_1_9",
"LIBSOUP_2_1_8",
"libsoup-hacking-branch-base",
"LIBSOUP_2_1_7",
"LIBSOUP_2_1_6",
"LIBSOUP_2_1_5",
"LIBSOUP_2_1_4",
"LIBSOUP_2_1_3",
"LIBSOUP_2_1_2",
"libsoup-2-0-branch-base",
"LIBSOUP_1_99_25",
"LIBSOUP_1_99_24",
"LIBSOUP_1_99_23",
"LIBSOUP_1_99_22",
"LIBSOUP_1_99_20",
"LIBSOUP_1_99_19",
"LIBSOUP_1_99_17",
"LIBSOUP_1_99_16",
"LIBSOUP_1_99_15",
"SOUP_0_6_0",
"SOUP_0_5",
"SOUP_0_4",
"SOUP_0_4_1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-46421.json"
}
}
],
"modified": "2026-10-28T02:30:24.629043423Z",
"provider": "osv",
"references": [
"https://access.redhat.com/downloads/content/package-browser/",
"https://access.redhat.com/errata/RHSA-2025:4439",
"https://access.redhat.com/errata/RHSA-2025:4440",
"https://access.redhat.com/errata/RHSA-2025:4508",
"https://access.redhat.com/errata/RHSA-2025:4538",
"https://access.redhat.com/errata/RHSA-2025:4560",
"https://access.redhat.com/errata/RHSA-2025:4568",
"https://access.redhat.com/errata/RHSA-2025:4609",
"https://access.redhat.com/errata/RHSA-2025:4624",
"https://access.redhat.com/errata/RHSA-2025:7436",
"https://access.redhat.com/errata/RHSA-2025:7505",
"https://access.redhat.com/security/cve/CVE-2025-46421",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46421.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-46421",
"https://bugzilla.redhat.com/show_bug.cgi?id=2361962",
"https://gitlab.gnome.org/GNOME/libsoup/-/issues/439",
"https://gitlab.gnome.org/GNOME/libsoup"
],
"provider_metadata": {
"cwe_ids": [
"CWE-497"
],
"cna_assigner": "redhat",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "0:3.6.5-3.el10_0"
},
{
"fixed": "0:2.62.3-8.el8_10"
},
{
"fixed": "0:2.62.3-8.el8_10"
},
{
"fixed": "0:2.62.3-1.el8_2.4"
},
{
"fixed": "0:2.62.3-2.el8_4.4"
},
{
"fixed": "0:2.62.3-2.el8_4.4"
},
{
"fixed": "0:2.62.3-2.el8_4.4"
},
{
"fixed": "0:2.62.3-2.el8_6.4"
},
{
"fixed": "0:2.62.3-2.el8_6.4"
},
{
"fixed": "0:2.62.3-2.el8_6.4"
},
{
"fixed": "0:2.62.3-3.el8_8.4"
},
{
"fixed": "0:2.72.0-10.el9_6.1"
},
{
"fixed": "0:2.72.0-8.el9_0.4"
},
{
"fixed": "0:2.72.0-8.el9_2.4"
},
{
"fixed": "0:2.72.0-8.el9_4.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "InverseAffectedRanges"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46421.json"
}
},
"related_cves": [
{
"value": "CVE-2025-46421",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 490983,
"published_at": "2025-04-24T13:01:24.589+00:00"
}