Cyber Resilience

CVE-2025-4035

Medium

Published: 29 April 2025

Published
29 April 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS Score 0.0026 49.9th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-4035 is a medium-severity Improper Handling of Case Sensitivity (CWE-178) vulnerability. Its CVSS base score is 4.3 (Medium).

Operationally, ranked at the 49.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and…

more

could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.

CWE(s)
CWE-178

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References