Summary
Tan Wei Chong discovered that libsoup incorrectly handled memory when
parsing HTTP request headers. An attacker could possibly use this issue to
send a maliciously crafted HTTP request to the server, causing a denial of
service. (CVE-2025-32906)
Alon Zahavi discovered that libsoup incorrectly parsed video files. An
attacker could possibly use this issue to send a maliciously crafted HTTP
response back to the client, causing a denial of service, or leading to
undefined behavior. (CVE-2025-32909)
Jan Różański discovered that libsoup incorrectly handled memory when
parsing authentication headers. An attacker could possibly use this issue
to send a maliciously crafted HTTP response back to the client, causing a
denial of service. (CVE-2025-32910, CVE-2025-32912)
It was discovered that libsoup incorrectly handled data in the hash table
data type. An attacker could possibly use this issue to send a maliciously
crafted HTTP request to the server, causing a denial of service or remote
code execution. (CVE-2025-32911)
Jan Różański discovered that libsoup incorrectly handled memory when
parsing the content disposition HTTP header. An attacker could possibly use
this issue to send maliciously crafted data to a client or server, causing
a denial of service. (CVE-2025-32913)
Alon Zahavi discovered that libsoup incorrectly handled memory when parsing
HTTP requests. An attacker could possibly use this issue to send a
maliciously crafted HTTP request to the server, causing a denial of service
or obtaining sensitive information. (CVE-2025-32914)
It was discovered that libsoup incorrectly handled memory when parsing
quality-list headers. An attacker could possibly use this issue to send a
maliciously crafted HTTP request to the server, causing a denial of
service. (CVE-2025-46420)
Jan Różański discovered that libsoup did not strip authorization
information upon redirects. An attacker could possibly use this issue to
obtain sensitive information. (CVE-2025-46421)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | libsoup2.4 | 2.70.0-1ubuntu0.3 |
| Ubuntu · 22.04 LTS 22.04:LTS | libsoup2.4 | 2.74.2-3ubuntu0.3 |
| Ubuntu · 24.04 LTS 24.04:LTS | libsoup2.4 | 2.74.3-6ubuntu1.3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libsoup2.4 | 2.52.2-1ubuntu0.3+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libsoup2.4 | 2.62.1-1ubuntu0.4+esm2 |
Vulnerabilities 9
-
Critical 9.0
Libsoup: double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" ghashtable value
A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.
-
High 7.5
Libsoup: out of bounds reads in soup_headers_parse_request()
A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server.
-
High 7.5
Libsoup: null pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in content-disposition header
A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client or server that uses this function.
-
High 7.4
Libsoup: oob read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process
A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds.
-
Medium 6.8
Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server
A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued …
-
Medium 6.5
Libsoup: null pointer deference on libsoup via /auth/soup-auth-digest.c through "soup_auth_digest_authenticate" on client when server omits the "realm" parameter in an unauthorized response with digest authentication
A flaw was found in libsoup, where soup_auth_digest_authenticate() is vulnerable to a NULL pointer dereference. This issue may cause the libsoup client to crash.
-
Medium 6.5
Libsoup: null pointer dereference in client when server omits the "nonce" parameter in an unauthorized response with digest authentication
A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash.
-
Medium 6.5
Libsoup: memory leak on soup_header_parse_quality_list() via soup-headers.c
A flaw was found in libsoup. It is vulnerable to memory leaks in the soup_header_parse_quality_list() function when parsing a quality list that contains elements with all zeroes.
-
Medium 5.3
Libsoup: null pointer dereference on libsoup through function "sniff_mp4" in soup-content-sniffer.c
A flaw was found in libsoup. SoupContentSniffer may be vulnerable to a NULL pointer dereference in the sniff_mp4 function. The HTTP server may cause the libsoup client to crash.
References
-
report
https://ubuntu.com/security/CVE-2025-32906
-
report
https://ubuntu.com/security/CVE-2025-32909
-
report
https://ubuntu.com/security/CVE-2025-32910
-
report
https://ubuntu.com/security/CVE-2025-32911
-
report
https://ubuntu.com/security/CVE-2025-32912
-
report
https://ubuntu.com/security/CVE-2025-32913
-
report
https://ubuntu.com/security/CVE-2025-32914
-
report
https://ubuntu.com/security/CVE-2025-46420
-
report
https://ubuntu.com/security/CVE-2025-46421