Summary
[3.6.5-3.el10_0.6]
- Fix CVE-2025-4035, CVE-2025-4948, CVE-2025-32049, CVE-2025-32907
[3.6.5-3]
- Add patch to hopefully fix http2-body-size-test timeouts
[3.6.5-2]
- Add patch to hopefully fix server-test timeouts
[3.6.5-1]
- Update to 3.6.5 and add patches for CVEs
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | libsoup3 | 0:3.6.5-3.el10_0.6 |
| Oracle Linux · 10 | libsoup3-devel | 0:3.6.5-3.el10_0.6 |
| Oracle Linux · 10 | libsoup3-doc | 0:3.6.5-3.el10_0.6 |
Vulnerabilities 4
-
High 7.5
Libsoup: denial of service attack to websocket server
A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).
-
High 7.5
Libsoup: integer underflow in soup_multipart_new_from_message() leading to denial of service in libsoup
A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart messag…
-
Medium 5.3
Libsoup: denial of service in server when client requests a large amount of overlapping ranges with range header
A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts o…
-
Medium 4.3
Libsoup: cookie domain validation bypass via uppercase characters in libsoup
A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and co…