Vulnerability in Red Hat Enterprise Linux 10
CVE-2025-9901
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.
EPSS: 0.004 (35.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking)
- secalert@redhat.com
Frequently asked questions
- What is CVE-2025-9901?
- CVE-2025-9901 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, classified under Use of Cache Containing Sensitive Information. CVSS score: 5.9/10. Published 2025-09-03.
- How severe is CVE-2025-9901?
- Medium severity. CVSS v3 base score is 5.9 out of 10.
- Is CVE-2025-9901 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.