High [CVE-2025-14523] Libsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins)

A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host.

This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers. This vulnerability is rated Important for Red Hat products that utilize libsoup in environments where applications are exposed via a front proxy.

The flaw arises from a discrepancy in how libsoup processes duplicate Host: headers (last-value wins) compared to many proxies (first-value wins). This mismatch can lead to virtual-host confusion, enabling attackers to bypass host-based access controls or perform cache poisoning.

Systems where libsoup applications are directly accessible without an intervening proxy are not affected by this specific issue. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N).

Weakness: CWE-444.