ECHO-0BD2-8B5E-2B5A SoupCache ignores the HTTP Vary header when reusing cached responses. The vulnerable path is only reachable when a client explicitly enables the optional on-disk SoupCache feature (soup_session_add_feature with SoupCache) AND acts as a shared/multi-user HTTP proxy — neither applies to Echo's use of libsoup3 as a client library. No upstream fix exists (a TODO in soup_cache_has_response(); issue #453 was closed as a duplicate of the still-open upstream issue #112). Debian rates it no-dsa, Minor. https://security-tracker.debian.org/tracker/CVE-2025-9901
| Reporter | Title | Published | Views | Family All 23 |
|---|---|---|---|---|
 | CVE-2025-9901 | 3 Sep 202512:32 | – | attackerkb |
 | CVE-2025-9901 | 3 Sep 202514:27 | – | circl |
 | libsoup 安全漏洞 | 3 Sep 202500:00 | – | cnnvd |
 | CVE-2025-9901 | 3 Sep 202512:32 | – | cve |
 | CVE-2025-9901 Libsoup: improper handling of http vary header in libsoup caching | 3 Sep 202512:32 | – | cvelist |
 | CVE-2025-9901 | 3 Sep 202512:32 | – | debiancve |
 | EUVD-2025-26502 | 3 Oct 202520:07 | – | euvd |
 | Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates | 1 Oct 202515:31 | – | ibm |
 | CVE-2025-9901 | 3 Sep 202512:32 | – | mend |
 | Libsoup: improper handling of http vary header in libsoup caching | 7 Sep 202508:17 | – | mscve |
10
| Source | Link |
|---|---|
| advisory | www.advisory.echohq.com/cve/CVE-2025-9901 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
15 Sep 2026 03:33Current
5.7Medium risk
Vulners AI Score5.7
CVSS 3.15.9
EPSS0.00453
SSVC