Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Libsoup 3 Vulnerability Allows Malicious Website Access

published 9 months ago

Summary

A security issue has been found in the Libsoup 3 library used by some applications to access web content. This issue could potentially allow a malicious website to access sensitive information or perform unauthorized actions on the user's system. Users should update their Libsoup 3 library to the latest version to fix this issue.

What to do

Update redhat libsoup3 to version 0:3.6.5-3.el10_0.11.
Update redhat libsoup3-debuginfo to version 0:3.6.5-3.el10_0.11.
Update redhat libsoup3-debugsource to version 0:3.6.5-3.el10_0.11.
Update redhat libsoup3-devel to version 0:3.6.5-3.el10_0.11.
Update redhat libsoup3-doc to version 0:3.6.5-3.el10_0.11.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux_eus:10.0	redhat	libsoup3	< 0:3.6.5-3.el10_0.11 Fix: upgrade to 0:3.6.5-3.el10_0.11
Red Hat:enterprise_linux_eus:10.0	redhat	libsoup3-debuginfo	< 0:3.6.5-3.el10_0.11 Fix: upgrade to 0:3.6.5-3.el10_0.11
Red Hat:enterprise_linux_eus:10.0	redhat	libsoup3-debugsource	< 0:3.6.5-3.el10_0.11 Fix: upgrade to 0:3.6.5-3.el10_0.11
Red Hat:enterprise_linux_eus:10.0	redhat	libsoup3-devel	< 0:3.6.5-3.el10_0.11 Fix: upgrade to 0:3.6.5-3.el10_0.11
Red Hat:enterprise_linux_eus:10.0	redhat	libsoup3-doc	< 0:3.6.5-3.el10_0.11 Fix: upgrade to 0:3.6.5-3.el10_0.11

Original advisory text

Red Hat Security Advisory: libsoup3 security update

References

https://access.redhat.com/errata/RHSA-2026:0836 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2421349 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0836.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-14523 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-14523 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-14523 Vendor Advisory
https://gitlab.gnome.org/GNOME/libsoup/-/issues/472 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

8.2 High

Timeline

Published20 Jan 2026

Updated4 Jul 2026

First seen4 Jul 2026

Sources

RHSA-2026:0836 · OSV

Track software like this

Free during beta