CVE-2025-4035Medium· 4.3▾ SunlitA flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suf…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.4%
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-40453Critical· 9.9The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'
CVE-2026-77560High· 8.1Tinyauth is an authentication and authorization server
CVE-2026-77281Medium· 6.5Caddy is an extensible server platform that uses TLS by default
CVE-2026-90982Medium· 5.3@fastify/static is a Fastify plugin that serves static files from a configured root directory
CVE-2026-27896High· 7.0MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity
CVE-2026-57441High· 8.4MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault