Vulnerability-Lookup

RHSA-2025:4568

Vulnerability from csaf_redhat - Published: 2025-05-06 16:48 - Updated: 2026-10-16 10:56

Summary

Red Hat Security Advisory: libsoup security update

Severity

Important

Notes

Topic: An update for libsoup is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The libsoup packages provide an HTTP client and server library for GNOME. Security Fix(es): * libsoup: Integer overflow in append_param_quoted (CVE-2025-32050) * libsoup: Heap buffer overflow in sniff_unknown() (CVE-2025-32052) * libsoup: Heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space() (CVE-2025-32053) * libsoup: Out of bounds reads in soup_headers_parse_request() (CVE-2025-32906) * libsoup: Double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" GHashTable value (CVE-2025-32911) * libsoup: NULL pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in Content-Disposition header (CVE-2025-32913) * libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server (CVE-2025-46421) * libsoup: Memory leak on soup_header_parse_quality_list() via soup-headers.c (CVE-2025-46420) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-32050

A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-127 - Buffer Under-read

Affected products

Fixed 31 products

Product	Version	Remediation
Unresolved product id: AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2025-32052

A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

CWE-126 - Buffer Over-read

Affected products

Fixed 31 products, the same list as for CVE-2025-32050

Threats

Impact Moderate

CVE-2025-32053

A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

CWE-126 - Buffer Over-read

Affected products

Fixed 31 products, the same list as for CVE-2025-32050

Threats

Impact Moderate

CVE-2025-32906

A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 31 products, the same list as for CVE-2025-32050

Threats

Impact Important

CVE-2025-32911

A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.

9.0 (Critical)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE-590 - Free of Memory not on the Heap

Affected products

Fixed 31 products, the same list as for CVE-2025-32050

Threats

Impact Important

CVE-2025-32913

A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client or server that uses this function.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 31 products, the same list as for CVE-2025-32050

Threats

Impact Important

CVE-2025-46420

A flaw was found in libsoup. It is vulnerable to memory leaks in the soup_header_parse_quality_list() function when parsing a quality list that contains elements with all zeroes.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-401 - Missing Release of Memory after Effective Lifetime

Affected products

Fixed 31 products, the same list as for CVE-2025-32050

Threats

Impact Moderate

CVE-2025-46421

A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.

6.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

Affected products

Fixed 31 products, the same list as for CVE-2025-32050

Threats

Impact Moderate

References

51 references

URL	Category
https://access.redhat.com/errata/RHSA-2025:4568	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2357067	external
https://bugzilla.redhat.com/show_bug.cgi?id=2357069	external
https://bugzilla.redhat.com/show_bug.cgi?id=2357070	external
https://bugzilla.redhat.com/show_bug.cgi?id=2359341	external
https://bugzilla.redhat.com/show_bug.cgi?id=2359355	external
https://bugzilla.redhat.com/show_bug.cgi?id=2359357	external
https://bugzilla.redhat.com/show_bug.cgi?id=2361962	external
https://bugzilla.redhat.com/show_bug.cgi?id=2361963	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-32050	self
https://bugzilla.redhat.com/show_bug.cgi?id=2357067	external
https://www.cve.org/CVERecord?id=CVE-2025-32050	external
https://nvd.nist.gov/vuln/detail/CVE-2025-32050	external
https://gitlab.gnome.org/GNOME/libsoup/-/issues/424	external
https://access.redhat.com/security/cve/CVE-2025-32052	self
https://bugzilla.redhat.com/show_bug.cgi?id=2357069	external
https://www.cve.org/CVERecord?id=CVE-2025-32052	external
https://nvd.nist.gov/vuln/detail/CVE-2025-32052	external
https://gitlab.gnome.org/GNOME/libsoup/-/issues/425	external
https://access.redhat.com/security/cve/CVE-2025-32053	self
https://bugzilla.redhat.com/show_bug.cgi?id=2357070	external
https://www.cve.org/CVERecord?id=CVE-2025-32053	external
https://nvd.nist.gov/vuln/detail/CVE-2025-32053	external
https://gitlab.gnome.org/GNOME/libsoup/-/issues/426	external
https://access.redhat.com/security/cve/CVE-2025-32906	self
https://bugzilla.redhat.com/show_bug.cgi?id=2359341	external
https://www.cve.org/CVERecord?id=CVE-2025-32906	external
https://nvd.nist.gov/vuln/detail/CVE-2025-32906	external
https://gitlab.gnome.org/GNOME/libsoup/-/issues/404	external
https://access.redhat.com/security/cve/CVE-2025-32911	self
https://bugzilla.redhat.com/show_bug.cgi?id=2359355	external
https://www.cve.org/CVERecord?id=CVE-2025-32911	external
https://nvd.nist.gov/vuln/detail/CVE-2025-32911	external
https://gitlab.gnome.org/GNOME/libsoup/-/issues/433	external
https://access.redhat.com/security/cve/CVE-2025-32913	self
https://bugzilla.redhat.com/show_bug.cgi?id=2359357	external
https://www.cve.org/CVERecord?id=CVE-2025-32913	external
https://nvd.nist.gov/vuln/detail/CVE-2025-32913	external
https://gitlab.gnome.org/GNOME/libsoup/-/issues/435	external
https://access.redhat.com/security/cve/CVE-2025-46420	self
https://bugzilla.redhat.com/show_bug.cgi?id=2361963	external
https://www.cve.org/CVERecord?id=CVE-2025-46420	external
https://nvd.nist.gov/vuln/detail/CVE-2025-46420	external
https://gitlab.gnome.org/GNOME/libsoup/-/issues/438	external
https://access.redhat.com/security/cve/CVE-2025-46421	self
https://bugzilla.redhat.com/show_bug.cgi?id=2361962	external
https://www.cve.org/CVERecord?id=CVE-2025-46421	external
https://nvd.nist.gov/vuln/detail/CVE-2025-46421	external
https://gitlab.gnome.org/GNOME/libsoup/-/issues/439	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for libsoup is now available for Red Hat Enterprise Linux 8.8 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The libsoup packages provide an HTTP client and server library for GNOME.\n\nSecurity Fix(es):\n\n* libsoup: Integer overflow in append_param_quoted (CVE-2025-32050)\n\n* libsoup: Heap buffer overflow in sniff_unknown() (CVE-2025-32052)\n\n* libsoup: Heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space() (CVE-2025-32053)\n\n* libsoup: Out of bounds reads in soup_headers_parse_request() (CVE-2025-32906)\n\n* libsoup: Double free on  soup_message_headers_get_content_disposition() through  \"soup-message-headers.c\" via \"params\" GHashTable value (CVE-2025-32911)\n\n* libsoup: NULL pointer dereference in  soup_message_headers_get_content_disposition when \"filename\" parameter  is present, but has no value in Content-Disposition header (CVE-2025-32913)\n\n* libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server (CVE-2025-46421)\n\n* libsoup: Memory leak on soup_header_parse_quality_list() via soup-headers.c (CVE-2025-46420)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:4568",
        "url": "https://access.redhat.com/errata/RHSA-2025:4568"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2357067",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357067"
      },
      {
        "category": "external",
        "summary": "2357069",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357069"
      },
      {
        "category": "external",
        "summary": "2357070",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357070"
      },
      {
        "category": "external",
        "summary": "2359341",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359341"
      },
      {
        "category": "external",
        "summary": "2359355",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359355"
      },
      {
        "category": "external",
        "summary": "2359357",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359357"
      },
      {
        "category": "external",
        "summary": "2361962",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361962"
      },
      {
        "category": "external",
        "summary": "2361963",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361963"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4568.json"
      }
    ],
    "title": "Red Hat Security Advisory: libsoup security update",
    "tracking": {
      "current_release_date": "2026-10-16T10:56:28+00:00",
      "generator": {
        "date": "2026-10-16T10:56:28+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2025:4568",
      "initial_release_date": "2025-05-06T16:48:22+00:00",
      "revision_history": [
        {
          "date": "2025-05-06T16:48:22+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-05-06T16:48:22+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-16T10:56:28+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v.8.8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v.8.8)",
                  "product_id": "AppStream-8.8.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus:8.8::appstream"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
                  "product_id": "BaseOS-8.8.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_eus:8.8::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
                "product": {
                  "name": "libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
                  "product_id": "libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-devel@2.62.3-3.el8_8.4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
                "product": {
                  "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
                  "product_id": "libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debugsource@2.62.3-3.el8_8.4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
                "product": {
                  "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
                  "product_id": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debuginfo@2.62.3-3.el8_8.4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-0:2.62.3-3.el8_8.4.aarch64",
                "product": {
                  "name": "libsoup-0:2.62.3-3.el8_8.4.aarch64",
                  "product_id": "libsoup-0:2.62.3-3.el8_8.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup@2.62.3-3.el8_8.4?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
                "product": {
                  "name": "libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
                  "product_id": "libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-devel@2.62.3-3.el8_8.4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
                "product": {
                  "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
                  "product_id": "libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debugsource@2.62.3-3.el8_8.4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
                "product": {
                  "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
                  "product_id": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debuginfo@2.62.3-3.el8_8.4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-0:2.62.3-3.el8_8.4.ppc64le",
                "product": {
                  "name": "libsoup-0:2.62.3-3.el8_8.4.ppc64le",
                  "product_id": "libsoup-0:2.62.3-3.el8_8.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup@2.62.3-3.el8_8.4?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.62.3-3.el8_8.4.i686",
                "product": {
                  "name": "libsoup-devel-0:2.62.3-3.el8_8.4.i686",
                  "product_id": "libsoup-devel-0:2.62.3-3.el8_8.4.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-devel@2.62.3-3.el8_8.4?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
                "product": {
                  "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
                  "product_id": "libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debugsource@2.62.3-3.el8_8.4?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
                "product": {
                  "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
                  "product_id": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debuginfo@2.62.3-3.el8_8.4?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-0:2.62.3-3.el8_8.4.i686",
                "product": {
                  "name": "libsoup-0:2.62.3-3.el8_8.4.i686",
                  "product_id": "libsoup-0:2.62.3-3.el8_8.4.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup@2.62.3-3.el8_8.4?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
                "product": {
                  "name": "libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
                  "product_id": "libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-devel@2.62.3-3.el8_8.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
                "product": {
                  "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
                  "product_id": "libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debugsource@2.62.3-3.el8_8.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
                "product": {
                  "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
                  "product_id": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debuginfo@2.62.3-3.el8_8.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-0:2.62.3-3.el8_8.4.x86_64",
                "product": {
                  "name": "libsoup-0:2.62.3-3.el8_8.4.x86_64",
                  "product_id": "libsoup-0:2.62.3-3.el8_8.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup@2.62.3-3.el8_8.4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
                "product": {
                  "name": "libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
                  "product_id": "libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-devel@2.62.3-3.el8_8.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
                "product": {
                  "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
                  "product_id": "libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debugsource@2.62.3-3.el8_8.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
                "product": {
                  "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
                  "product_id": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debuginfo@2.62.3-3.el8_8.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-0:2.62.3-3.el8_8.4.s390x",
                "product": {
                  "name": "libsoup-0:2.62.3-3.el8_8.4.s390x",
                  "product_id": "libsoup-0:2.62.3-3.el8_8.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup@2.62.3-3.el8_8.4?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-0:2.62.3-3.el8_8.4.src",
                "product": {
                  "name": "libsoup-0:2.62.3-3.el8_8.4.src",
                  "product_id": "libsoup-0:2.62.3-3.el8_8.4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup@2.62.3-3.el8_8.4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64"
        },
        "product_reference": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686"
        },
        "product_reference": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le"
        },
        "product_reference": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x"
        },
        "product_reference": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
        "relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64"
        },
        "product_reference": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64"
        },
        "product_reference": "libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686"
        },
        "product_reference": "libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le"
        },
        "product_reference": "libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x"
        },
        "product_reference": "libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
        "relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
        },
        "product_reference": "libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.62.3-3.el8_8.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64"
        },
        "product_reference": "libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.62.3-3.el8_8.4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686"
        },
        "product_reference": "libsoup-devel-0:2.62.3-3.el8_8.4.i686",
        "relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le"
        },
        "product_reference": "libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.62.3-3.el8_8.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x"
        },
        "product_reference": "libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
        "relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.62.3-3.el8_8.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64"
        },
        "product_reference": "libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.62.3-3.el8_8.4.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64"
        },
        "product_reference": "libsoup-0:2.62.3-3.el8_8.4.aarch64",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.62.3-3.el8_8.4.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686"
        },
        "product_reference": "libsoup-0:2.62.3-3.el8_8.4.i686",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.62.3-3.el8_8.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le"
        },
        "product_reference": "libsoup-0:2.62.3-3.el8_8.4.ppc64le",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.62.3-3.el8_8.4.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x"
        },
        "product_reference": "libsoup-0:2.62.3-3.el8_8.4.s390x",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.62.3-3.el8_8.4.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src"
        },
        "product_reference": "libsoup-0:2.62.3-3.el8_8.4.src",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.62.3-3.el8_8.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64"
        },
        "product_reference": "libsoup-0:2.62.3-3.el8_8.4.x86_64",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64"
        },
        "product_reference": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686"
        },
        "product_reference": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le"
        },
        "product_reference": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x"
        },
        "product_reference": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64"
        },
        "product_reference": "libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64"
        },
        "product_reference": "libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686"
        },
        "product_reference": "libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le"
        },
        "product_reference": "libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x"
        },
        "product_reference": "libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.8.8)",
          "product_id": "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
        },
        "product_reference": "libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
        "relates_to_product_reference": "BaseOS-8.8.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-32050",
      "cwe": {
        "id": "CWE-127",
        "name": "Buffer Under-read"
      },
      "discovery_date": "2025-04-03T01:17:42.454000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2357067"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsoup: Integer overflow in append_param_quoted",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-32050"
        },
        {
          "category": "external",
          "summary": "RHBZ#2357067",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357067"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-32050",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-32050"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32050",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32050"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/424",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/424"
        }
      ],
      "release_date": "2025-04-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-06T16:48:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:4568"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available for this vulnerability.",
          "product_ids": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libsoup: Integer overflow in append_param_quoted"
    },
    {
      "cve": "CVE-2025-32052",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "discovery_date": "2025-04-03T01:16:47.177000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2357069"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsoup: Heap buffer overflow in sniff_unknown()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate severity heap buffer over-read flaw was found in the libsoup content sniffer, in the sniff_unknown() function of soup-content-sniffer.c. A remote attacker who controls an HTTP server can send a crafted HTTP response to a client application using libsoup, causing the content sniffer to read beyond the bounds of a heap-allocated buffer when determining the content type. This out-of-bounds read can lead to disclosure of information from process memory or cause the client application to crash, consistent with the Red Hat severity rating of Moderate (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), which matches the upstream rating. Red Hat Enterprise Linux 8 and 9 (libsoup), Red Hat In-Vehicle OS (libsoup), and products shipping the mingw-libsoup variant are affected, and a fix is being pursued through the respective product streams. Red Hat Enterprise Linux 10 is not affected because the vulnerable code is not present in its libsoup3 packages.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-32052"
        },
        {
          "category": "external",
          "summary": "RHBZ#2357069",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357069"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-32052",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-32052"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32052",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32052"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/425",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/425"
        }
      ],
      "release_date": "2025-04-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-06T16:48:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:4568"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available for this vulnerability.",
          "product_ids": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libsoup: Heap buffer overflow in sniff_unknown()"
    },
    {
      "cve": "CVE-2025-32053",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "discovery_date": "2025-04-03T01:16:47.321000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2357070"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsoup: Heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate severity vulnerability was found in libsoup, where heap buffer over-reads can occur in the content sniffer\u0027s sniff_feed_or_html() and skip_insignificant_space() functions. A remote attacker who controls an HTTP server that a libsoup-based client connects to could send a crafted HTTP response that causes the client to read out of bounds, potentially resulting in a crash or exposure of out-of-bounds heap memory contents. Red Hat has rated this flaw Moderate severity with a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), consistent with the upstream assessment. The libsoup package as shipped in Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat In-Vehicle OS is affected, and fixes are being pursued through the respective product maintenance streams. Red Hat Enterprise Linux 10, which ships the libsoup3 package, is not affected because the vulnerable code is not present in that version.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-32053"
        },
        {
          "category": "external",
          "summary": "RHBZ#2357070",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357070"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-32053",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-32053"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32053",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32053"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/426",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/426"
        }
      ],
      "release_date": "2025-04-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-06T16:48:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:4568"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available for this vulnerability.",
          "product_ids": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libsoup: Heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space()"
    },
    {
      "cve": "CVE-2025-32906",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2025-04-14T01:27:05.130000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2359341"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsoup: Out of bounds reads in soup_headers_parse_request()",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-32906"
        },
        {
          "category": "external",
          "summary": "RHBZ#2359341",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359341"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-32906",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-32906"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32906",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32906"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/404",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/404"
        }
      ],
      "release_date": "2025-04-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-06T16:48:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:4568"
        },
        {
          "category": "workaround",
          "details": "Currently, no mitigation was found for this vulnerability.",
          "product_ids": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libsoup: Out of bounds reads in soup_headers_parse_request()"
    },
    {
      "cve": "CVE-2025-32911",
      "cwe": {
        "id": "CWE-590",
        "name": "Free of Memory not on the Heap"
      },
      "discovery_date": "2025-04-14T01:21:00.518000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2359355"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsoup: Double free on  soup_message_headers_get_content_disposition() through  \"soup-message-headers.c\" via \"params\" GHashTable value",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-32911"
        },
        {
          "category": "external",
          "summary": "RHBZ#2359355",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359355"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-32911",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-32911"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32911",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32911"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/433",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/433"
        }
      ],
      "release_date": "2025-04-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-06T16:48:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:4568"
        },
        {
          "category": "workaround",
          "details": "Currently, no mitigation is available for this vulnerability.",
          "product_ids": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.0,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libsoup: Double free on  soup_message_headers_get_content_disposition() through  \"soup-message-headers.c\" via \"params\" GHashTable value"
    },
    {
      "cve": "CVE-2025-32913",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2025-04-14T01:21:01.010000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2359357"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client or server that uses this function.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsoup: NULL pointer dereference in  soup_message_headers_get_content_disposition when \"filename\" parameter  is present, but has no value in Content-Disposition header",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-32913"
        },
        {
          "category": "external",
          "summary": "RHBZ#2359357",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359357"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-32913",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-32913"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32913",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32913"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/435",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/435"
        }
      ],
      "release_date": "2025-04-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-06T16:48:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:4568"
        },
        {
          "category": "workaround",
          "details": "Currently, no mitigation is available for this vulnerability.",
          "product_ids": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libsoup: NULL pointer dereference in  soup_message_headers_get_content_disposition when \"filename\" parameter  is present, but has no value in Content-Disposition header"
    },
    {
      "cve": "CVE-2025-46420",
      "cwe": {
        "id": "CWE-401",
        "name": "Missing Release of Memory after Effective Lifetime"
      },
      "discovery_date": "2025-04-24T01:33:03.009000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2361963"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libsoup. It is vulnerable to memory leaks in the soup_header_parse_quality_list() function when parsing a quality list that contains elements with all zeroes.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsoup: Memory leak on soup_header_parse_quality_list() via soup-headers.c",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate impact memory leak flaw was found in libsoup. When the soup_header_parse_quality_list() function in soup-headers.c parses a quality list in which any element\u0027s quality value consists entirely of zeroes (for example q=0, q=0.0, or q=0.000), the parsed elements are not freed and memory is leaked in proportion to the size of the crafted values, which may carry a large number of trailing zeroes. A remote attacker able to have an application using libsoup parse such crafted HTTP quality-list headers could trigger this leak repeatedly, eventually exhausting available memory and causing a denial of service. The affected libsoup packages ship in Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 9, where fixes have been delivered through the respective update streams, and in Red Hat In-Vehicle OS, where the fix is being pursued through the platform\u0027s update process. Red Hat Enterprise Linux 10 ships libsoup3, which does not contain the vulnerable code and is therefore not affected. The Red Hat severity rating (Moderate, CVSS 6.5) is consistent with the upstream rating.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-46420"
        },
        {
          "category": "external",
          "summary": "RHBZ#2361963",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361963"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-46420",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-46420"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-46420",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46420"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/438",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/438"
        }
      ],
      "release_date": "2025-04-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-06T16:48:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:4568"
        },
        {
          "category": "workaround",
          "details": "Currently, no mitigation is available for this vulnerability.",
          "product_ids": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libsoup: Memory leak on soup_header_parse_quality_list() via soup-headers.c"
    },
    {
      "cve": "CVE-2025-46421",
      "cwe": {
        "id": "CWE-497",
        "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere"
      },
      "discovery_date": "2025-04-24T01:35:00.884000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2361962"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate-severity information disclosure flaw was found in libsoup, affecting the libsoup and libsoup3 components as shipped in Red Hat Enterprise Linux 8, 9, and 10, and Red Hat In-Vehicle OS, with the issue delegated to the Fedora community for community-project packages. When a libsoup-based client follows an HTTP redirect, it mistakenly sends the HTTP Authorization header to the new host that the redirect points to. This allows the host that is the target of the redirection to capture the client\u0027s credentials and impersonate the user to the original host that issued the redirect. Exploitation requires network access with high attack complexity, no privileges, and user interaction, and affects the confidentiality and integrity of the authenticated session but not availability. Red Hat and the upstream CVE record both assess this flaw with a CVSS score of 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N), so the Red Hat severity matches upstream. A fix for the affected Red Hat products is being pursued.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
          "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
          "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
          "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-46421"
        },
        {
          "category": "external",
          "summary": "RHBZ#2361962",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361962"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-46421",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-46421"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-46421",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46421"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/439",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/439"
        }
      ],
      "release_date": "2025-04-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-06T16:48:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:4568"
        },
        {
          "category": "workaround",
          "details": "Currently, no mitigation is available for this vulnerability.",
          "product_ids": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.aarch64",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.i686",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.ppc64le",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.s390x",
            "AppStream-8.8.0.Z.EUS:libsoup-devel-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.src",
            "BaseOS-8.8.0.Z.EUS:libsoup-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debuginfo-0:2.62.3-3.el8_8.4.x86_64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.aarch64",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.i686",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.ppc64le",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.s390x",
            "BaseOS-8.8.0.Z.EUS:libsoup-debugsource-0:2.62.3-3.el8_8.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server"
    }
  ]
}

CVE-2025-32050 (GCVE-0-2025-32050)

Vulnerability from cvelistv5 – Published: 2025-04-03 13:36 – Updated: 2026-06-30 00:33

Title

Libsoup: integer overflow in append_param_quoted

Summary

A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-03 14:56 UTC

CWE

CWE-127 - Buffer Under-read

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1039 records in the last 180 days details

References

10 references

URL	Tags
https://access.redhat.com/errata/RHSA-2025:4440	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4508	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4560	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4568	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:7436	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:8292	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-32050	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2357067	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/libsoup/-/issues/424
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

11 products

Vendor	Product	Version
		Affected: 0 , < 3.6.1 (semver)
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:2.62.3-8.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:2.8-3.el8_10.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:8.10-1 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:2.62.3-3.el8_8.4 , < * (rpm) cpe:/a:redhat:rhel_eus:8.8::appstream cpe:/o:redhat:rhel_eus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.72.0-10.el9_6.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:2.72.0-8.el9_2.4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:2.72.0-8.el9_4.4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7

Date Public

2025-04-03 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-32050",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-03T14:56:24.491360Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-03T14:57:28.366Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:53:14.249Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00036.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/libsoup/",
          "defaultStatus": "unaffected",
          "packageName": "libsoup",
          "versions": [
            {
              "lessThan": "3.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-8.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "mingw-freetype",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.8-3.el8_10.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "spice-client-win",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:8.10-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-8.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream",
            "cpe:/o:redhat:rhel_eus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-3.el8_8.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-10.el9_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_2.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "libsoup3",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-04-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-127",
              "description": "Buffer Under-read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T00:33:51.130Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2025:4440",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4440"
        },
        {
          "name": "RHSA-2025:4508",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4508"
        },
        {
          "name": "RHSA-2025:4560",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4560"
        },
        {
          "name": "RHSA-2025:4568",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4568"
        },
        {
          "name": "RHSA-2025:7436",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:7436"
        },
        {
          "name": "RHSA-2025:8292",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:8292"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-32050"
        },
        {
          "name": "RHBZ#2357067",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357067"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/424"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-04-03T01:17:42.454Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-04-03T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libsoup: integer overflow in append_param_quoted",
      "workarounds": [
        {
          "lang": "en",
          "value": "No mitigation is currently available for this vulnerability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-127: Buffer Under-read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-32050",
    "datePublished": "2025-04-03T13:36:29.141Z",
    "dateReserved": "2025-04-03T01:42:14.135Z",
    "dateUpdated": "2026-06-30T00:33:51.130Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-32052 (GCVE-0-2025-32052)

Vulnerability from cvelistv5 – Published: 2025-04-03 13:37 – Updated: 2026-06-30 00:33

Title

Libsoup: heap buffer overflow in sniff_unknown()

Summary

A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-03 14:44 UTC

CWE

CWE-126 - Buffer Over-read

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1039 records in the last 180 days details

References

10 references

URL	Tags
https://access.redhat.com/errata/RHSA-2025:4440	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4508	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4560	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4568	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:7436	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:8292	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-32052	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2357069	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/libsoup/-/issues/425
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

11 products

Vendor	Product	Version
		Affected: 0 , < 3.6.1 (semver)
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:2.62.3-8.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:2.8-3.el8_10.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:8.10-1 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:2.62.3-3.el8_8.4 , < * (rpm) cpe:/a:redhat:rhel_eus:8.8::appstream cpe:/o:redhat:rhel_eus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.72.0-10.el9_6.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:2.72.0-8.el9_2.4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:2.72.0-8.el9_4.4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7

Date Public

2025-04-03 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-32052",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-03T14:44:39.371468Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-03T14:45:08.025Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:53:15.629Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00036.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/libsoup/",
          "defaultStatus": "unaffected",
          "packageName": "libsoup",
          "versions": [
            {
              "lessThan": "3.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-8.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "mingw-freetype",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.8-3.el8_10.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "spice-client-win",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:8.10-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-8.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream",
            "cpe:/o:redhat:rhel_eus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-3.el8_8.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-10.el9_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_2.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "libsoup3",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-04-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-126",
              "description": "Buffer Over-read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T00:33:56.608Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2025:4440",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4440"
        },
        {
          "name": "RHSA-2025:4508",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4508"
        },
        {
          "name": "RHSA-2025:4560",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4560"
        },
        {
          "name": "RHSA-2025:4568",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4568"
        },
        {
          "name": "RHSA-2025:7436",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:7436"
        },
        {
          "name": "RHSA-2025:8292",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:8292"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-32052"
        },
        {
          "name": "RHBZ#2357069",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357069"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/425"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-04-03T01:16:47.177Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-04-03T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libsoup: heap buffer overflow in sniff_unknown()",
      "workarounds": [
        {
          "lang": "en",
          "value": "No mitigation is currently available for this vulnerability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-126: Buffer Over-read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-32052",
    "datePublished": "2025-04-03T13:37:23.109Z",
    "dateReserved": "2025-04-03T01:42:14.135Z",
    "dateUpdated": "2026-06-30T00:33:56.608Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-32053 (GCVE-0-2025-32053)

Vulnerability from cvelistv5 – Published: 2025-04-03 13:37 – Updated: 2026-06-30 00:33

Title

Libsoup: heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space()

Summary

A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-03 14:04 UTC

CWE

CWE-126 - Buffer Over-read

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1039 records in the last 180 days details

References

10 references

URL	Tags
https://access.redhat.com/errata/RHSA-2025:4440	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4508	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4560	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4568	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:7436	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:8292	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-32053	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2357070	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/libsoup/-/issues/426
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

11 products

Vendor	Product	Version
		Affected: 0 , < 3.6.1 (semver)
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:2.62.3-8.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:2.8-3.el8_10.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:8.10-1 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:2.62.3-3.el8_8.4 , < * (rpm) cpe:/a:redhat:rhel_eus:8.8::appstream cpe:/o:redhat:rhel_eus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.72.0-10.el9_6.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:2.72.0-8.el9_2.4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:2.72.0-8.el9_4.4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7

Date Public

2025-04-03 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-32053",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-03T14:04:01.420300Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-03T14:04:16.262Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:53:16.968Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00036.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/libsoup/",
          "defaultStatus": "unaffected",
          "packageName": "libsoup",
          "versions": [
            {
              "lessThan": "3.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-8.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "mingw-freetype",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.8-3.el8_10.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "spice-client-win",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:8.10-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-8.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream",
            "cpe:/o:redhat:rhel_eus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-3.el8_8.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-10.el9_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_2.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "libsoup3",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-04-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-126",
              "description": "Buffer Over-read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T00:33:56.673Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2025:4440",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4440"
        },
        {
          "name": "RHSA-2025:4508",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4508"
        },
        {
          "name": "RHSA-2025:4560",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4560"
        },
        {
          "name": "RHSA-2025:4568",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4568"
        },
        {
          "name": "RHSA-2025:7436",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:7436"
        },
        {
          "name": "RHSA-2025:8292",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:8292"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-32053"
        },
        {
          "name": "RHBZ#2357070",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357070"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/426"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-04-03T01:16:47.321Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-04-03T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libsoup: heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space()",
      "workarounds": [
        {
          "lang": "en",
          "value": "No mitigation is currently available for this vulnerability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-126: Buffer Over-read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-32053",
    "datePublished": "2025-04-03T13:37:39.054Z",
    "dateReserved": "2025-04-03T01:42:14.135Z",
    "dateUpdated": "2026-06-30T00:33:56.673Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-32906 (GCVE-0-2025-32906)

Vulnerability from cvelistv5 – Published: 2025-04-14 13:58 – Updated: 2026-06-29 20:39

Title

Libsoup: out of bounds reads in soup_headers_parse_request()

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-14 14:13 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1039 records in the last 180 days details

References

17 references

URL	Tags
https://access.redhat.com/errata/RHSA-2025:21657	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4439	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4440	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4508	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4538	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4560	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4568	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4609	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4624	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:7436	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:7505	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:8292	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:9179	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-32906	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2359341	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/libsoup/-/issues/404
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

20 products

Vendor	Product	Version
		Affected: 0 , < 3.6.5 (semver)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.6.5-3.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:2.62.2-9.el7_9 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:2.62.2-6.el7_9 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:2.62.3-8.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:2.8-3.el8_10.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:8.10-1 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:2.62.3-1.el8_2.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.2::appstream cpe:/o:redhat:rhel_aus:8.2::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:2.62.3-2.el8_4.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_e4s:8.4::baseos cpe:/o:redhat:rhel_tus:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	Unaffected: 0:2.62.3-2.el8_4.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_e4s:8.4::baseos cpe:/o:redhat:rhel_tus:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	Unaffected: 0:2.62.3-2.el8_4.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_e4s:8.4::baseos cpe:/o:redhat:rhel_tus:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:2.62.3-2.el8_6.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:2.62.3-2.el8_6.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:2.62.3-2.el8_6.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:2.62.3-3.el8_8.4 , < * (rpm) cpe:/a:redhat:rhel_eus:8.8::appstream cpe:/o:redhat:rhel_eus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.72.0-10.el9_6.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:2.72.0-8.el9_0.4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:2.72.0-8.el9_2.4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:2.72.0-8.el9_4.4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6

Date Public

2025-04-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-32906",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-14T14:13:49.519508Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-14T18:06:07.759Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:53:40.598Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00036.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/libsoup/",
          "defaultStatus": "unaffected",
          "packageName": "libsoup",
          "versions": [
            {
              "lessThan": "3.6.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.0"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup3",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.5-3.el10_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.2-9.el7_9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.2-6.el7_9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-8.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "mingw-freetype",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.8-3.el8_10.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "spice-client-win",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:8.10-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-8.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.2::appstream",
            "cpe:/o:redhat:rhel_aus:8.2::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-1.el8_2.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_e4s:8.4::baseos",
            "cpe:/o:redhat:rhel_tus:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_e4s:8.4::baseos",
            "cpe:/o:redhat:rhel_tus:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_e4s:8.4::baseos",
            "cpe:/o:redhat:rhel_tus:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_6.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_6.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_6.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream",
            "cpe:/o:redhat:rhel_eus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-3.el8_8.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-10.el9_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_0.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_2.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-04-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T20:39:25.195Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2025:21657",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:21657"
        },
        {
          "name": "RHSA-2025:4439",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4439"
        },
        {
          "name": "RHSA-2025:4440",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4440"
        },
        {
          "name": "RHSA-2025:4508",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4508"
        },
        {
          "name": "RHSA-2025:4538",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4538"
        },
        {
          "name": "RHSA-2025:4560",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4560"
        },
        {
          "name": "RHSA-2025:4568",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4568"
        },
        {
          "name": "RHSA-2025:4609",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4609"
        },
        {
          "name": "RHSA-2025:4624",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4624"
        },
        {
          "name": "RHSA-2025:7436",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:7436"
        },
        {
          "name": "RHSA-2025:7505",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:7505"
        },
        {
          "name": "RHSA-2025:8292",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:8292"
        },
        {
          "name": "RHSA-2025:9179",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:9179"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-32906"
        },
        {
          "name": "RHBZ#2359341",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359341"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/404"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-04-14T01:27:05.130Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-04-14T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libsoup: out of bounds reads in soup_headers_parse_request()",
      "workarounds": [
        {
          "lang": "en",
          "value": "Currently, no mitigation was found for this vulnerability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-125: Out-of-bounds Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-32906",
    "datePublished": "2025-04-14T13:58:39.718Z",
    "dateReserved": "2025-04-14T01:37:48.152Z",
    "dateUpdated": "2026-06-29T20:39:25.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-32911 (GCVE-0-2025-32911)

Vulnerability from cvelistv5 – Published: 2025-04-15 15:39 – Updated: 2026-06-29 21:26

Title

Libsoup: double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" ghashtable value

Summary

Severity

9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-15 15:57 UTC

CWE

CWE-590 - Free of Memory not on the Heap

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1039 records in the last 180 days details

References

16 references

URL	Tags
https://access.redhat.com/errata/RHSA-2025:21657	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4439	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4440	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4508	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4538	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4560	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4568	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4609	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4624	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:7436	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:8292	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:9179	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-32911	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2359355	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/libsoup/-/issues/433
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

20 products

Vendor	Product	Version
		Affected: 0 , < 3.6.3 (semver)
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:2.62.2-9.el7_9 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:2.62.2-6.el7_9 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:2.62.3-8.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:2.8-3.el8_10.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:8.10-1 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:2.62.3-1.el8_2.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.2::appstream cpe:/o:redhat:rhel_aus:8.2::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:2.62.3-2.el8_4.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_e4s:8.4::baseos cpe:/o:redhat:rhel_tus:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	Unaffected: 0:2.62.3-2.el8_4.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_e4s:8.4::baseos cpe:/o:redhat:rhel_tus:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	Unaffected: 0:2.62.3-2.el8_4.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_e4s:8.4::baseos cpe:/o:redhat:rhel_tus:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:2.62.3-2.el8_6.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:2.62.3-2.el8_6.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:2.62.3-2.el8_6.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:2.62.3-3.el8_8.4 , < * (rpm) cpe:/a:redhat:rhel_eus:8.8::appstream cpe:/o:redhat:rhel_eus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.72.0-10.el9_6.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:2.72.0-8.el9_0.4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:2.72.0-8.el9_2.4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:2.72.0-8.el9_4.4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6

Date Public

2025-04-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-32911",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-15T15:57:21.589990Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-15T15:57:38.074Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:53:44.770Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00036.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/libsoup/",
          "defaultStatus": "unaffected",
          "packageName": "libsoup",
          "versions": [
            {
              "lessThan": "3.6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.2-9.el7_9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.2-6.el7_9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-8.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "mingw-freetype",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.8-3.el8_10.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "spice-client-win",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:8.10-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-8.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.2::appstream",
            "cpe:/o:redhat:rhel_aus:8.2::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-1.el8_2.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_e4s:8.4::baseos",
            "cpe:/o:redhat:rhel_tus:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_e4s:8.4::baseos",
            "cpe:/o:redhat:rhel_tus:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_e4s:8.4::baseos",
            "cpe:/o:redhat:rhel_tus:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_6.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_6.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_6.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream",
            "cpe:/o:redhat:rhel_eus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-3.el8_8.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-10.el9_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_0.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_2.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "libsoup3",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-04-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-590",
              "description": "Free of Memory not on the Heap",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T21:26:53.846Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2025:21657",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:21657"
        },
        {
          "name": "RHSA-2025:4439",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4439"
        },
        {
          "name": "RHSA-2025:4440",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4440"
        },
        {
          "name": "RHSA-2025:4508",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4508"
        },
        {
          "name": "RHSA-2025:4538",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4538"
        },
        {
          "name": "RHSA-2025:4560",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4560"
        },
        {
          "name": "RHSA-2025:4568",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4568"
        },
        {
          "name": "RHSA-2025:4609",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4609"
        },
        {
          "name": "RHSA-2025:4624",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4624"
        },
        {
          "name": "RHSA-2025:7436",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:7436"
        },
        {
          "name": "RHSA-2025:8292",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:8292"
        },
        {
          "name": "RHSA-2025:9179",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:9179"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-32911"
        },
        {
          "name": "RHBZ#2359355",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359355"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/433"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-04-14T01:21:00.518Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-04-14T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libsoup: double free on  soup_message_headers_get_content_disposition() through  \"soup-message-headers.c\" via \"params\" ghashtable value",
      "workarounds": [
        {
          "lang": "en",
          "value": "Currently, no mitigation is available for this vulnerability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-590: Free of Memory not on the Heap"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-32911",
    "datePublished": "2025-04-15T15:39:34.919Z",
    "dateReserved": "2025-04-14T01:59:13.827Z",
    "dateUpdated": "2026-06-29T21:26:53.846Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-32913 (GCVE-0-2025-32913)

Vulnerability from cvelistv5 – Published: 2025-04-14 13:37 – Updated: 2026-06-29 20:39

Title

Libsoup: null pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in content-disposition header

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-14 13:54 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1039 records in the last 180 days details

References

16 references

URL	Tags
https://access.redhat.com/errata/RHSA-2025:21657	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4439	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4440	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4508	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4538	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4560	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4568	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4609	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4624	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:7436	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:8292	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:9179	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-32913	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2359357	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/libsoup/-/issues/435
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

20 products

Vendor	Product	Version
		Affected: 0 , < 3.6.2 (semver)
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:2.62.2-9.el7_9 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:2.62.2-6.el7_9 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:2.62.3-8.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:2.8-3.el8_10.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:8.10-1 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:2.62.3-1.el8_2.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.2::appstream cpe:/o:redhat:rhel_aus:8.2::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:2.62.3-2.el8_4.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_e4s:8.4::baseos cpe:/o:redhat:rhel_tus:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	Unaffected: 0:2.62.3-2.el8_4.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_e4s:8.4::baseos cpe:/o:redhat:rhel_tus:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	Unaffected: 0:2.62.3-2.el8_4.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_e4s:8.4::baseos cpe:/o:redhat:rhel_tus:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:2.62.3-2.el8_6.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:2.62.3-2.el8_6.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:2.62.3-2.el8_6.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:2.62.3-3.el8_8.4 , < * (rpm) cpe:/a:redhat:rhel_eus:8.8::appstream cpe:/o:redhat:rhel_eus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.72.0-10.el9_6.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:2.72.0-8.el9_0.4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:2.72.0-8.el9_2.4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:2.72.0-8.el9_4.4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6

Date Public

2025-04-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-32913",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-14T13:54:02.941942Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-14T13:54:31.425Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:53:47.523Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00036.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/libsoup/",
          "defaultStatus": "unaffected",
          "packageName": "libsoup",
          "versions": [
            {
              "lessThan": "3.6.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.2-9.el7_9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.2-6.el7_9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-8.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "mingw-freetype",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.8-3.el8_10.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "spice-client-win",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:8.10-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-8.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.2::appstream",
            "cpe:/o:redhat:rhel_aus:8.2::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-1.el8_2.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_e4s:8.4::baseos",
            "cpe:/o:redhat:rhel_tus:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_e4s:8.4::baseos",
            "cpe:/o:redhat:rhel_tus:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_e4s:8.4::baseos",
            "cpe:/o:redhat:rhel_tus:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_6.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_6.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_6.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream",
            "cpe:/o:redhat:rhel_eus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-3.el8_8.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-10.el9_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_0.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_2.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "libsoup3",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-04-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client or server that uses this function."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T20:39:38.676Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2025:21657",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:21657"
        },
        {
          "name": "RHSA-2025:4439",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4439"
        },
        {
          "name": "RHSA-2025:4440",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4440"
        },
        {
          "name": "RHSA-2025:4508",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4508"
        },
        {
          "name": "RHSA-2025:4538",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4538"
        },
        {
          "name": "RHSA-2025:4560",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4560"
        },
        {
          "name": "RHSA-2025:4568",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4568"
        },
        {
          "name": "RHSA-2025:4609",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4609"
        },
        {
          "name": "RHSA-2025:4624",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4624"
        },
        {
          "name": "RHSA-2025:7436",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:7436"
        },
        {
          "name": "RHSA-2025:8292",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:8292"
        },
        {
          "name": "RHSA-2025:9179",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:9179"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-32913"
        },
        {
          "name": "RHBZ#2359357",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359357"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/435"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-04-14T01:21:01.010Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-04-14T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libsoup: null pointer dereference in  soup_message_headers_get_content_disposition when \"filename\" parameter  is present, but has no value in content-disposition header",
      "workarounds": [
        {
          "lang": "en",
          "value": "Currently, no mitigation is available for this vulnerability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-476: NULL Pointer Dereference"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-32913",
    "datePublished": "2025-04-14T13:37:36.587Z",
    "dateReserved": "2025-04-14T01:59:13.827Z",
    "dateUpdated": "2026-06-29T20:39:38.676Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-46420 (GCVE-0-2025-46420)

Vulnerability from cvelistv5 – Published: 2025-04-24 12:58 – Updated: 2026-07-25 01:08

Title

Libsoup: memory leak on soup_header_parse_quality_list() via soup-headers.c

Summary

A flaw was found in libsoup. It is vulnerable to memory leaks in the soup_header_parse_quality_list() function when parsing a quality list that contains elements with all zeroes.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-24 13:14 UTC

CWE

CWE-401 - Missing Release of Memory after Effective Lifetime

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1039 records in the last 180 days details

References

12 references

URL	Tags
https://access.redhat.com/errata/RHSA-2025:4439	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4440	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4508	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4538	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4560	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4568	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4609	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4624	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:7436	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-46420	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2361963	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/libsoup/-/issues/438

Impacted products

17 products

Vendor	Product	Version
		Affected: 0 , < 3.6.3 (semver)
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:2.62.3-8.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:2.62.3-1.el8_2.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.2::appstream cpe:/o:redhat:rhel_aus:8.2::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:2.62.3-2.el8_4.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_e4s:8.4::baseos cpe:/o:redhat:rhel_tus:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	Unaffected: 0:2.62.3-2.el8_4.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_e4s:8.4::baseos cpe:/o:redhat:rhel_tus:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	Unaffected: 0:2.62.3-2.el8_4.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_e4s:8.4::baseos cpe:/o:redhat:rhel_tus:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:2.62.3-2.el8_6.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:2.62.3-2.el8_6.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:2.62.3-2.el8_6.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:2.62.3-3.el8_8.4 , < * (rpm) cpe:/a:redhat:rhel_eus:8.8::appstream cpe:/o:redhat:rhel_eus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.72.0-10.el9_6.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:2.72.0-8.el9_0.4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:2.72.0-8.el9_2.4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:2.72.0-8.el9_4.4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7

Date Public

2025-04-24 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-46420",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-24T13:14:47.382231Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-25T01:08:07.835Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/libsoup",
          "defaultStatus": "unaffected",
          "packageName": "libsoup",
          "versions": [
            {
              "lessThan": "3.6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-8.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-8.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.2::appstream",
            "cpe:/o:redhat:rhel_aus:8.2::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-1.el8_2.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_e4s:8.4::baseos",
            "cpe:/o:redhat:rhel_tus:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_e4s:8.4::baseos",
            "cpe:/o:redhat:rhel_tus:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_e4s:8.4::baseos",
            "cpe:/o:redhat:rhel_tus:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_6.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_6.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_6.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream",
            "cpe:/o:redhat:rhel_eus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-3.el8_8.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-10.el9_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_0.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_2.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "libsoup3",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-04-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libsoup. It is vulnerable to memory leaks in the soup_header_parse_quality_list() function when parsing a quality list that contains elements with all zeroes."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "Missing Release of Memory after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T03:06:44.572Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2025:4439",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4439"
        },
        {
          "name": "RHSA-2025:4440",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4440"
        },
        {
          "name": "RHSA-2025:4508",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4508"
        },
        {
          "name": "RHSA-2025:4538",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4538"
        },
        {
          "name": "RHSA-2025:4560",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4560"
        },
        {
          "name": "RHSA-2025:4568",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4568"
        },
        {
          "name": "RHSA-2025:4609",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4609"
        },
        {
          "name": "RHSA-2025:4624",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4624"
        },
        {
          "name": "RHSA-2025:7436",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:7436"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-46420"
        },
        {
          "name": "RHBZ#2361963",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361963"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/438"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-04-24T01:33:03.009Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-04-24T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libsoup: memory leak on soup_header_parse_quality_list() via soup-headers.c",
      "workarounds": [
        {
          "lang": "en",
          "value": "Currently, no mitigation is available for this vulnerability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-401: Missing Release of Memory after Effective Lifetime"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-46420",
    "datePublished": "2025-04-24T12:58:01.121Z",
    "dateReserved": "2025-04-24T01:37:42.412Z",
    "dateUpdated": "2026-07-25T01:08:07.835Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-46421 (GCVE-0-2025-46421)

Vulnerability from cvelistv5 – Published: 2025-04-24 13:01 – Updated: 2026-07-25 01:08

Title

Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server

Summary

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-24 13:12 UTC

CWE

CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1039 records in the last 180 days details

References

13 references

URL	Tags
https://access.redhat.com/errata/RHSA-2025:4439	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4440	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4508	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4538	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4560	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4568	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4609	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4624	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:7436	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:7505	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-46421	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2361962	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/libsoup/-/issues/439

Impacted products

17 products

Vendor	Product	Version
		Affected: 0 , < 3.6.5 (semver)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.6.5-3.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:2.62.3-8.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:2.62.3-1.el8_2.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.2::appstream cpe:/o:redhat:rhel_aus:8.2::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:2.62.3-2.el8_4.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_e4s:8.4::baseos cpe:/o:redhat:rhel_tus:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	Unaffected: 0:2.62.3-2.el8_4.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_e4s:8.4::baseos cpe:/o:redhat:rhel_tus:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	Unaffected: 0:2.62.3-2.el8_4.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_e4s:8.4::baseos cpe:/o:redhat:rhel_tus:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:2.62.3-2.el8_6.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:2.62.3-2.el8_6.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:2.62.3-2.el8_6.4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:2.62.3-3.el8_8.4 , < * (rpm) cpe:/a:redhat:rhel_eus:8.8::appstream cpe:/o:redhat:rhel_eus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.72.0-10.el9_6.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:2.72.0-8.el9_0.4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:2.72.0-8.el9_2.4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:2.72.0-8.el9_4.4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7

Date Public

2025-04-24 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-46421",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-24T13:12:43.291380Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-25T01:08:35.817Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/libsoup",
          "defaultStatus": "unaffected",
          "packageName": "libsoup",
          "versions": [
            {
              "lessThan": "3.6.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.0"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup3",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.5-3.el10_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-8.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-8.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.2::appstream",
            "cpe:/o:redhat:rhel_aus:8.2::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-1.el8_2.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_e4s:8.4::baseos",
            "cpe:/o:redhat:rhel_tus:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_e4s:8.4::baseos",
            "cpe:/o:redhat:rhel_tus:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_e4s:8.4::baseos",
            "cpe:/o:redhat:rhel_tus:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_6.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_6.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-2.el8_6.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream",
            "cpe:/o:redhat:rhel_eus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-3.el8_8.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-10.el9_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_0.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_2.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_4.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-04-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-497",
              "description": "Exposure of Sensitive System Information to an Unauthorized Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T03:06:47.188Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2025:4439",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4439"
        },
        {
          "name": "RHSA-2025:4440",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4440"
        },
        {
          "name": "RHSA-2025:4508",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4508"
        },
        {
          "name": "RHSA-2025:4538",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4538"
        },
        {
          "name": "RHSA-2025:4560",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4560"
        },
        {
          "name": "RHSA-2025:4568",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4568"
        },
        {
          "name": "RHSA-2025:4609",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4609"
        },
        {
          "name": "RHSA-2025:4624",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:4624"
        },
        {
          "name": "RHSA-2025:7436",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:7436"
        },
        {
          "name": "RHSA-2025:7505",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:7505"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-46421"
        },
        {
          "name": "RHBZ#2361962",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361962"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/439"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-04-24T01:35:00.884Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-04-24T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server",
      "workarounds": [
        {
          "lang": "en",
          "value": "Currently, no mitigation is available for this vulnerability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-46421",
    "datePublished": "2025-04-24T13:01:24.589Z",
    "dateReserved": "2025-04-24T01:37:42.413Z",
    "dateUpdated": "2026-07-25T01:08:35.817Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2025:4568

CVE-2025-32050 (GCVE-0-2025-32050)

CVE-2025-32052 (GCVE-0-2025-32052)

CVE-2025-32053 (GCVE-0-2025-32053)

CVE-2025-32906 (GCVE-0-2025-32906)

CVE-2025-32911 (GCVE-0-2025-32911)

CVE-2025-32913 (GCVE-0-2025-32913)

CVE-2025-46420 (GCVE-0-2025-46420)

CVE-2025-46421 (GCVE-0-2025-46421)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour