CVE-2025-4035

What it actually does

The flaw permits libsoup clients to accept cookies for public suffix domains when the domain has two or more components and contains an uppercase letter, bypassing public suffix list checks and enabling unauthorized cookie setting that can cause integrity violations such as session fixation.

Why it matters to the business

Attackers may hijack or fixate user sessions in affected Mattermost deployments, leading to unauthorized access, data integrity problems, and potential disruption of collaborative workflows; the issue affects a widely used open-source platform with many downstream installations.

How an attack unfolds

An attacker registers or controls a domain containing an uppercase letter and at least two components that matches a public suffix pattern, then serves content that sets cookies scoped to a target public suffix; the vulnerable client accepts the cookies, allowing the attacker to inject session tokens for domains it does not legitimately own.

How to fix it

Upgrade affected Mattermost components to one of the fixed versions: github.com/mattermost/mattermost/server/v8 to 10.1.4, 10.0.4, 9.11.6 or 10.2.1; mattermost/mattermost to commit ff3c76437efdef1fdf44f92434ac588e4d4e964c; mattermost/mattermost-server to commit 51ac054df0cf662ef3fa4657df4e058a33687135. Verify the update resolves the libsoup cookie-handling logic.

How to confirm the fix worked

Confirm the installed package versions match the listed fixed releases, review changelog entries for the cookie public-suffix fix, and test that uppercase domains no longer bypass suffix protections by attempting cookie-setting requests against public suffixes.

Typical attack path

1. Identify a public suffix domain and craft a subdomain containing an uppercase character
2. Host malicious content that issues Set-Cookie headers targeting the public suffix
3. Lure a victim user or automated client to visit the malicious content
4. Victim client accepts and stores the attacker-controlled cookies
5. Attacker uses the injected cookies to perform session fixation or impersonation on the target domain

How to detect it

Review application and web-server logs for unexpected cookie Set-Cookie headers originating from external domains, inspect session tokens for anomalies that suggest fixation, and correlate with client requests containing mixed-case public suffix domains.

What your security team should do

• Apply the listed fixed versions to all Mattermost server instances without delay
• Audit cookie-handling behavior in any custom clients or integrations that depend on libsoup
• Monitor vendor advisories for related updates in the broader ecosystem