Red Hat Security Advisory: libsoup security update

Fixed packages 6

Vulnerabilities 4

• High 7.5
  CVE-2025-32049

  Libsoup: denial of service attack to websocket server

  A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Apr 3, 2025
• High 7.5
  CVE-2025-4948

  Libsoup: integer underflow in soup_multipart_new_from_message() leading to denial of service in libsoup

  A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart messag…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  May 19, 2025
• High 7.4
  CVE-2025-32914

  Libsoup: oob read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process

  A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Apr 14, 2025
• High 7.0
  CVE-2025-2784

  Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content

  A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Apr 3, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2354669
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2357066
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2359358
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2367183
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8480.json
• report
  https://access.redhat.com/security/cve/CVE-2025-2784
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-2784
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-2784
• article
  https://gitlab.gnome.org/GNOME/libsoup/-/issues/422
• report
  https://access.redhat.com/security/cve/CVE-2025-4948
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-4948
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-4948
• article
  https://gitlab.gnome.org/GNOME/libsoup/-/issues/449
• report
  https://access.redhat.com/security/cve/CVE-2025-32049
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-32049
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-32049
• article
  https://gitlab.gnome.org/GNOME/libsoup/-/issues/390
• article
  https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/408
• report
  https://access.redhat.com/security/cve/CVE-2025-32914
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-32914
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-32914
• article
  https://gitlab.gnome.org/GNOME/libsoup/-/issues/436