CVE-2025-4035

Name	CVE-2025-4035
Description	A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1104414, 1104415

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libsoup2.4 (PTS)	bullseye	2.72.0-2	vulnerable
	bullseye (security)	2.72.0-2+deb11u2	vulnerable
	bookworm	2.74.3-1+deb12u1	vulnerable
	sid, trixie	2.74.3-10.1	vulnerable
libsoup3 (PTS)	bookworm	3.2.2-2	vulnerable
	sid, trixie	3.6.5-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libsoup2.4	source	(unstable)	(unfixed)			1104415
libsoup3	source	(unstable)	(unfixed)			1104414

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2362651
https://gitlab.gnome.org/GNOME/libsoup/-/issues/443
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/448