CVE-2025-4945 Details

A vulnerability has been identified in the libsoup HTTP library, which is utilized in GNOME applications and other software. This flaw arises from an integer overflow in the cookie parsing logic, specifically when processing expiration dates. A specially crafted cookie value can trigger this overflow, leading to undefined behavior. As a result, an attacker could manipulate cookie expiration logic, causing cookies to persist longer than intended or behave unpredictably. The issue originates from inadequate validation of large integer inputs during date calculations in the cookie parsing routines.

Red Hat advises avoiding interactions with untrusted or compromised HTTP servers until a patched version of libsoup is available. Users should monitor for suspicious HTTP activity and apply updates as soon as a fix is released.