High ELSA-2026-0422 1 CVE

Important: libsoup security update (Oracle Linux 9)

Published Jan 12, 2026 · Updated Jan 12, 2026

Ecosystem: Oracle Linux

Summary

[2.72.0-12.3]
- Fix patch for CVE-2025-14523 to handle comparison case-insensitively

[2.72.0-12.2]
- Backport patch for CVE-2025-14523

[2.72.0-12.1]
- Backport patch for CVE-2025-4945 and CVE-2025-11021

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 9	libsoup	0:2.72.0-12.el9_7.3
Oracle Linux · 9	libsoup-devel	0:2.72.0-12.el9_7.3

Vulnerabilities 1

High 8.2

CVE-2025-14523

Libsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins)

A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy r…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux

Dec 11, 2025