CVE-2025-14523 Details

A vulnerability in libsoup's handling of HTTP headers allows the inclusion of multiple Host headers in a request, with the last occurrence being processed by the server. This can create discrepancies with common front proxies that typically honor the first Host header, leading to virtual host confusion. As a result, a proxy might route a request to one backend, while the backend interprets it as intended for a different host. This vulnerability can be exploited to perform request-smuggling attacks, poison caches, or bypass host-based access controls by manipulating duplicate Host headers.