A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw could result in unintended disclosure of memory contents, potentially exposing sensitive information from the process using libsoup.
Conclusion & alert: CVE-2025-11021 is rated Moderate Risk (43.3/100): CVSS High severity, with low exploitation likelihood (EPSS 0.47%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.07% | 0.47% | +0.40% |
| 2 | 2026-03-06 | 0.05% | 0.07% | +0.02% |
| 3 | 2026-02-22 | — | 0.05% | — |
Full EPSS history (5 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2025-11021 not yet assigned priority: Debian including 1 source packages (libsoup3), 4 status rows across 4 suites (bookworm, forky, sid, trixie): open 2, resolved 2. | https://security-tracker.debian.org/tracker/CVE-2025-11021 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2025-11021 |
suse
|
high | CVE-2025-11021 severity important: SUSE including 36 source package names (13.2-9.1:libsqlite3-0-3.49.1-1.1, 13.2-9.1:strace-6.7-2.1, …), 111 product×package rows across 42 product lines (Container suse/sl-micro/6.0/baremetal-os-container, Container suse/sl-micro/6.0/base-os-container, … (42 product lines)): Fixed 107, First Fixed 4. | https://www.suse.com/security/cve/CVE-2025-11021/ |
ubuntu
|
medium | CVE-2025-11021 medium priority: Ubuntu including 2 source packages (libsoup2.4, libsoup3), 13 status rows across 8 suites (bionic, focal, jammy, noble, plucky, questing, upstream, xenial): released 11, needs-triage 2. | https://ubuntu.com/security/CVE-2025-11021 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| No affected products in dataset. | |||