Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-32914: A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds. CVE-2025-32908: A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS). CVE-2025-32907: A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libsoup3 | 0:3.6.5-48.amzn2023 |
| Amazon Linux · 2023 | libsoup3-debuginfo | 0:3.6.5-48.amzn2023 |
| Amazon Linux · 2023 | libsoup3-debugsource | 0:3.6.5-48.amzn2023 |
| Amazon Linux · 2023 | libsoup3-devel | 0:3.6.5-48.amzn2023 |
| Amazon Linux · 2023 | libsoup3-doc | 0:3.6.5-48.amzn2023 |
Vulnerabilities 3
-
High 7.5
Libsoup: denial of service on libsoup through http/2 server
A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS).
-
High 7.4
Libsoup: oob read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process
A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds.
-
Medium 5.3
Libsoup: denial of service in server when client requests a large amount of overlapping ranges with range header
A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts o…