CVE-2025-9901

What it actually does

The flaw causes SoupCache to serve cached HTTP responses without evaluating the Vary header, allowing responses that should differ based on request headers such as authentication or Accept-Language to be incorrectly reused across unrelated requests.

Why it matters to the business

In proxy or multi-user server environments, this can expose one user's sensitive data (such as authentication tokens or personal content) to other users, resulting in privacy violations, regulatory exposure, and loss of trust.

How an attack unfolds

An attacker positioned to interact with a shared cache first issues requests that populate responses under specific header combinations, then issues follow-on requests with different headers that should trigger distinct responses; the cache incorrectly returns the prior response, disclosing another party's data.

How to fix it

Upgrade to a patched version of libsoup that correctly implements Vary header checks inside SoupCache; until then, disable SoupCache in proxy or multi-user deployments or add application-level response isolation.

How to confirm the fix worked

Test the cache with pairs of requests that differ only in Vary-relevant headers and confirm distinct responses are returned; review cache logs or configuration for any remaining Vary bypasses after the upgrade.

Typical attack path

1. Locate a proxy or multi-user deployment that uses libsoup caching
2. Issue requests with varying header sets to seed the cache
3. Trigger cache hits using requests whose headers differ from the cached entry
4. Capture or observe the reused response containing another user's sensitive information

How to detect it

Review access and cache logs for repeated cache-hit entries served to different clients or under different authentication contexts; correlate timestamps of cache population with subsequent deliveries of potentially sensitive content.

What your security team should do

• Inventory all uses of libsoup caching in proxy or shared environments
• Prioritize upgrades in internet-facing or multi-tenant deployments
• Add compensating controls such as per-user cache namespaces where upgrades are delayed
• Include cache behavior in regular privacy and information-disclosure testing