Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-32914: A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds. CVE-2025-32913: A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client or server that uses this function. CVE-2025-32911: libsoup: Double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" GHashTable value CVE-2025-32907: A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. CVE-2025-32906: A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libsoup | 0:2.56.0-6.amzn2.0.3 |
| Amazon Linux · 2 | libsoup-debuginfo | 0:2.56.0-6.amzn2.0.3 |
| Amazon Linux · 2 | libsoup-devel | 0:2.56.0-6.amzn2.0.3 |
Vulnerabilities 5
-
Critical 9.0
Libsoup: double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" ghashtable value
A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.
-
High 7.5
Libsoup: out of bounds reads in soup_headers_parse_request()
A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server.
-
High 7.5
Libsoup: null pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in content-disposition header
A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client or server that uses this function.
-
High 7.4
Libsoup: oob read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process
A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds.
-
Medium 5.3
Libsoup: denial of service in server when client requests a large amount of overlapping ranges with range header
A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts o…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-32906.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-32907.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-32911.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-32913.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-32914.html