CVE-2025-14523: Red Hat Enterprise Linux 10

High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days.

A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.

Affected products

Red Hat Red Hat Enterprise Linux 10: before 0:3.6.5-3.el10_1.8 (fixed in 0:3.6.5-3.el10_1.8)
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support: before 0:3.6.5-3.el10_0.11 (fixed in 0:3.6.5-3.el10_0.11)
Red Hat Red Hat Enterprise Linux 6
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support: before 0:2.62.2-10.el7_9 (fixed in 0:2.62.2-10.el7_9)
Red Hat Red Hat Enterprise Linux 8: before 0:2.62.3-11.el8_10 (fixed in 0:2.62.3-11.el8_10); before 0:8.10-6.el8_10.1 (fixed in 0:8.10-6.el8_10.1)
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support: before 0:2.62.3-1.el8_2.7 (fixed in 0:2.62.3-1.el8_2.7); before 0:8.10-6.el8_2.1 (fixed in 0:8.10-6.el8_2.1)
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: before 0:2.62.3-2.el8_4.7 (fixed in 0:2.62.3-2.el8_4.7); before 0:8.10-6.el8_4.1 (fixed in 0:8.10-6.el8_4.1)
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: before 0:2.62.3-2.el8_4.7 (fixed in 0:2.62.3-2.el8_4.7); before 0:8.10-6.el8_4.1 (fixed in 0:8.10-6.el8_4.1)
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: before 0:2.62.3-2.el8_6.7 (fixed in 0:2.62.3-2.el8_6.7); before 0:8.10-6.el8_6.1 (fixed in 0:8.10-6.el8_6.1)
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service: before 0:2.62.3-2.el8_6.7 (fixed in 0:2.62.3-2.el8_6.7); before 0:8.10-6.el8_6.1 (fixed in 0:8.10-6.el8_6.1)
Red Hat Red Hat Enterprise Linux 8.6 Update Services For SAP Solutions: before 0:2.62.3-2.el8_6.7 (fixed in 0:2.62.3-2.el8_6.7); before 0:8.10-6.el8_6.1 (fixed in 0:8.10-6.el8_6.1)
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service: before 0:2.62.3-3.el8_8.7 (fixed in 0:2.62.3-3.el8_8.7); before 0:8.10-6.el8_8.1 (fixed in 0:8.10-6.el8_8.1)
Red Hat Red Hat Enterprise Linux 8.8 Update Services For SAP Solutions: before 0:2.62.3-3.el8_8.7 (fixed in 0:2.62.3-3.el8_8.7); before 0:8.10-6.el8_8.1 (fixed in 0:8.10-6.el8_8.1)
Red Hat Red Hat Enterprise Linux 9: before 0:2.72.0-12.el9_7.3 (fixed in 0:2.72.0-12.el9_7.3)
Red Hat Red Hat Enterprise Linux 9.0 Update Services For SAP Solutions: before 0:2.72.0-8.el9_0.8 (fixed in 0:2.72.0-8.el9_0.8)
Red Hat Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions: before 0:2.72.0-8.el9_2.8 (fixed in 0:2.72.0-8.el9_2.8)
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support: before 0:2.72.0-8.el9_4.8 (fixed in 0:2.72.0-8.el9_4.8)
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support: before 0:2.72.0-10.el9_6.5 (fixed in 0:2.72.0-10.el9_6.5)

Published 2025-12-11. Last modified 2026-10-07.