Summary
Jan Różański discovered that libsoup incorrectly handled range headers in
an HTTP request. An attacker could possibly use this issue to cause libsoup
to consume excessive memory, resulting in a denial of service.
(CVE-2025-32907)
Alon Zahavi discovered that libsoup incorrectly handled memory when parsing
HTTP requests. An attacker could possibly use this issue to send a
maliciously crafted HTTP request to the server, causing a denial of service
or obtaining sensitive information. This issue only affected Ubuntu 25.04.
(CVE-2025-32914)
It was discovered that libsoup incorrectly handled memory when parsing
the expiration date of maliciously crafted cookies. An attacker could
possibly use this issue to cause a denial of service. (CVE-2025-4945)
It was discovered that libsoup incorrectly handled integer calculations
when parsing multipart data. An attacker could possibly use this issue to
cause a denial of service. (CVE-2025-4948)
It was discovered that libsoup incorrectly handled buffer reading when
locating boundaries in multipart forms. An attacker could possibly use this
issue to cause a denial of service or obtain sensitive information.
(CVE-2025-4969)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libsoup2.4 | 2.74.2-3ubuntu0.6 |
| Ubuntu · 24.04 LTS 24.04:LTS | libsoup2.4 | 2.74.3-6ubuntu1.6 |
| Ubuntu · 24.04 LTS 24.04:LTS | libsoup3 | 3.4.4-5ubuntu0.5 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libsoup2.4 | 2.52.2-1ubuntu0.3+esm5 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libsoup2.4 | 2.62.1-1ubuntu0.4+esm6 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libsoup2.4 | 2.70.0-1ubuntu0.5+esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | libsoup3 | 3.0.7-0ubuntu1+esm5 |
Vulnerabilities 5
-
High 7.5
Libsoup: integer underflow in soup_multipart_new_from_message() leading to denial of service in libsoup
A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart messag…
-
High 7.4
Libsoup: oob read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process
A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds.
-
Medium 6.5
Libsoup: off-by-one out-of-bounds read in find_boundary() in soup-multipart.c
A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted multipart HTTP body, causing the libsoup-consuming …
-
Medium 5.3
Libsoup: denial of service in server when client requests a large amount of overlapping ranges with range header
A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts o…
-
Low 3.7
Libsoup: integer overflow in cookie expiration date handling in libsoup
A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. …