vulnerability

Ubuntu: (CVE-2025-4035): libsoup2.4 vulnerability

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:N/C:N/I:P/A:N)

Published

Apr 29, 2025

Added

Jun 26, 2025

Modified

Mar 27, 2026

Description

A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.

Solution

no-fix-ubuntu-package

References

CVE-2025-4035
https://attackerkb.com/topics/CVE-2025-4035
CWE-178
EUVD-EUVD-2025-15014
https://access.redhat.com/security/cve/CVE-2025-4035
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-15014
https://www.cve.org/CVERecord?id=CVE-2025-4035

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report