---
id: CVE-2025-4945
title: >-
  A flaw was found in the cookie parsing logic of the libsoup HTTP library, used
  in GNOME applications and other software
summary: >-
  A flaw was found in the cookie parsing logic of the libsoup HTTP library, used
  in GNOME applications and other software. The vulnerability arises when
  processing the expiration date of cookies, where a specially crafted value can
  trigger…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-190
published: '2025-05-19'
updated: '2026-06-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-4945'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2025:19713'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:19714'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:19720'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:20959'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21032'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21655'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21656'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21657'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21664'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21665'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21666'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21772'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22013'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2025-4945'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2367175'
    label: secalert@redhat.com
  - url: 'https://gitlab.gnome.org/GNOME/libsoup/-/issues/448'
    label: secalert@redhat.com
  - url: 'https://gitlab.gnome.org/GNOME/libsoup/-/issues/448'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.0067
epssPercentile: 0.50593
ingestedAt: '2026-06-29T13:24:34.322Z'
---

## Overview

A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior. The issue stems from improper validation of large integer inputs during date arithmetic operations within the cookie parsing routines.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.