Red Hat Security Advisory: libsoup3 security update

Fixed packages 5

Vulnerabilities 4

• High 7.5
  CVE-2025-32049

  Libsoup: denial of service attack to websocket server

  A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Apr 3, 2025
• High 7.5
  CVE-2025-4948

  Libsoup: integer underflow in soup_multipart_new_from_message() leading to denial of service in libsoup

  A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart messag…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  May 19, 2025
• Medium 5.3
  CVE-2025-32907

  Libsoup: denial of service in server when client requests a large amount of overlapping ranges with range header

  A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts o…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Apr 14, 2025
• Medium 4.3
  CVE-2025-4035

  Libsoup: cookie domain validation bypass via uppercase characters in libsoup

  A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and co…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Apr 29, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2357066
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2359342
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2362651
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2367183
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8128.json
• report
  https://access.redhat.com/security/cve/CVE-2025-4035
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-4035
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-4035
• article
  https://gitlab.gnome.org/GNOME/libsoup/-/issues/443
• report
  https://access.redhat.com/security/cve/CVE-2025-4948
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-4948
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-4948
• article
  https://gitlab.gnome.org/GNOME/libsoup/-/issues/449
• report
  https://access.redhat.com/security/cve/CVE-2025-32049
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-32049
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-32049
• article
  https://gitlab.gnome.org/GNOME/libsoup/-/issues/390
• article
  https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/408
• report
  https://access.redhat.com/security/cve/CVE-2025-32907
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-32907
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-32907
• article
  https://gitlab.gnome.org/GNOME/libsoup/-/issues/428