RHSA-2025:4440

Vulnerability from csaf_redhat - Published: 2025-05-05 01:24 - Updated: 2026-10-16 10:56
Summary
Red Hat Security Advisory: libsoup security update
Severity
Important
Notes
Topic: An update for libsoup is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The libsoup packages provide an HTTP client and server library for GNOME. Security Fix(es): * libsoup: Integer overflow in append_param_quoted (CVE-2025-32050) * libsoup: Heap buffer overflow in sniff_unknown() (CVE-2025-32052) * libsoup: Heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space() (CVE-2025-32053) * libsoup: Out of bounds reads in soup_headers_parse_request() (CVE-2025-32906) * libsoup: Denial of service in server when client requests a large amount of overlapping ranges with Range header (CVE-2025-32907) * libsoup: Double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" GHashTable value (CVE-2025-32911) * libsoup: NULL pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in Content-Disposition header (CVE-2025-32913) * libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server (CVE-2025-46421) * libsoup: Memory leak on soup_header_parse_quality_list() via soup-headers.c (CVE-2025-46420) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2025-32050

A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-127 - Buffer Under-read
Affected products
Product Identifier Version Remediation
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2025-32052

A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CWE-126 - Buffer Over-read
Affected products
Fixed 21 products, the same list as for CVE-2025-32050
Threats
Impact Moderate
CVE-2025-32053

A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CWE-126 - Buffer Over-read
Affected products
Fixed 21 products, the same list as for CVE-2025-32050
Threats
Impact Moderate
CVE-2025-32906

A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 21 products, the same list as for CVE-2025-32050
Threats
Impact Important
CVE-2025-32907

A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-1050 - Excessive Platform Resource Consumption within a Loop
Affected products
Fixed 21 products, the same list as for CVE-2025-32050
Threats
Impact Moderate
CVE-2025-32911

A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.

9.0 (Critical)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-590 - Free of Memory not on the Heap
Affected products
Fixed 21 products, the same list as for CVE-2025-32050
Threats
Impact Important
CVE-2025-32913

A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client or server that uses this function.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 21 products, the same list as for CVE-2025-32050
Threats
Impact Important
CVE-2025-46420

A flaw was found in libsoup. It is vulnerable to memory leaks in the soup_header_parse_quality_list() function when parsing a quality list that contains elements with all zeroes.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE-401 - Missing Release of Memory after Effective Lifetime
Affected products
Fixed 21 products, the same list as for CVE-2025-32050
Threats
Impact Moderate
CVE-2025-46421

A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.

6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products
Fixed 21 products, the same list as for CVE-2025-32050
Threats
Impact Moderate
References
URL Category
https://access.redhat.com/errata/RHSA-2025:4440 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2357067 external
https://bugzilla.redhat.com/show_bug.cgi?id=2357069 external
https://bugzilla.redhat.com/show_bug.cgi?id=2357070 external
https://bugzilla.redhat.com/show_bug.cgi?id=2359341 external
https://bugzilla.redhat.com/show_bug.cgi?id=2359342 external
https://bugzilla.redhat.com/show_bug.cgi?id=2359355 external
https://bugzilla.redhat.com/show_bug.cgi?id=2359357 external
https://bugzilla.redhat.com/show_bug.cgi?id=2361962 external
https://bugzilla.redhat.com/show_bug.cgi?id=2361963 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2025-32050 self
https://bugzilla.redhat.com/show_bug.cgi?id=2357067 external
https://www.cve.org/CVERecord?id=CVE-2025-32050 external
https://nvd.nist.gov/vuln/detail/CVE-2025-32050 external
https://gitlab.gnome.org/GNOME/libsoup/-/issues/424 external
https://access.redhat.com/security/cve/CVE-2025-32052 self
https://bugzilla.redhat.com/show_bug.cgi?id=2357069 external
https://www.cve.org/CVERecord?id=CVE-2025-32052 external
https://nvd.nist.gov/vuln/detail/CVE-2025-32052 external
https://gitlab.gnome.org/GNOME/libsoup/-/issues/425 external
https://access.redhat.com/security/cve/CVE-2025-32053 self
https://bugzilla.redhat.com/show_bug.cgi?id=2357070 external
https://www.cve.org/CVERecord?id=CVE-2025-32053 external
https://nvd.nist.gov/vuln/detail/CVE-2025-32053 external
https://gitlab.gnome.org/GNOME/libsoup/-/issues/426 external
https://access.redhat.com/security/cve/CVE-2025-32906 self
https://bugzilla.redhat.com/show_bug.cgi?id=2359341 external
https://www.cve.org/CVERecord?id=CVE-2025-32906 external
https://nvd.nist.gov/vuln/detail/CVE-2025-32906 external
https://gitlab.gnome.org/GNOME/libsoup/-/issues/404 external
https://access.redhat.com/security/cve/CVE-2025-32907 self
https://bugzilla.redhat.com/show_bug.cgi?id=2359342 external
https://www.cve.org/CVERecord?id=CVE-2025-32907 external
https://nvd.nist.gov/vuln/detail/CVE-2025-32907 external
https://gitlab.gnome.org/GNOME/libsoup/-/issues/428 external
https://access.redhat.com/security/cve/CVE-2025-32911 self
https://bugzilla.redhat.com/show_bug.cgi?id=2359355 external
https://www.cve.org/CVERecord?id=CVE-2025-32911 external
https://nvd.nist.gov/vuln/detail/CVE-2025-32911 external
https://gitlab.gnome.org/GNOME/libsoup/-/issues/433 external
https://access.redhat.com/security/cve/CVE-2025-32913 self
https://bugzilla.redhat.com/show_bug.cgi?id=2359357 external
https://www.cve.org/CVERecord?id=CVE-2025-32913 external
https://nvd.nist.gov/vuln/detail/CVE-2025-32913 external
https://gitlab.gnome.org/GNOME/libsoup/-/issues/435 external
https://access.redhat.com/security/cve/CVE-2025-46420 self
https://bugzilla.redhat.com/show_bug.cgi?id=2361963 external
https://www.cve.org/CVERecord?id=CVE-2025-46420 external
https://nvd.nist.gov/vuln/detail/CVE-2025-46420 external
https://gitlab.gnome.org/GNOME/libsoup/-/issues/438 external
https://access.redhat.com/security/cve/CVE-2025-46421 self
https://bugzilla.redhat.com/show_bug.cgi?id=2361962 external
https://www.cve.org/CVERecord?id=CVE-2025-46421 external
https://nvd.nist.gov/vuln/detail/CVE-2025-46421 external
https://gitlab.gnome.org/GNOME/libsoup/-/issues/439 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for libsoup is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The libsoup packages provide an HTTP client and server library for GNOME.\n\nSecurity Fix(es):\n\n* libsoup: Integer overflow in append_param_quoted (CVE-2025-32050)\n\n* libsoup: Heap buffer overflow in sniff_unknown() (CVE-2025-32052)\n\n* libsoup: Heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space() (CVE-2025-32053)\n\n* libsoup: Out of bounds reads in soup_headers_parse_request() (CVE-2025-32906)\n\n* libsoup: Denial of service in server when client requests a large amount of  overlapping ranges with Range header (CVE-2025-32907)\n\n* libsoup: Double free on  soup_message_headers_get_content_disposition() through  \"soup-message-headers.c\" via \"params\" GHashTable value (CVE-2025-32911)\n\n* libsoup: NULL pointer dereference in  soup_message_headers_get_content_disposition when \"filename\" parameter  is present, but has no value in Content-Disposition header (CVE-2025-32913)\n\n* libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server (CVE-2025-46421)\n\n* libsoup: Memory leak on soup_header_parse_quality_list() via soup-headers.c (CVE-2025-46420)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:4440",
        "url": "https://access.redhat.com/errata/RHSA-2025:4440"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2357067",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357067"
      },
      {
        "category": "external",
        "summary": "2357069",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357069"
      },
      {
        "category": "external",
        "summary": "2357070",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357070"
      },
      {
        "category": "external",
        "summary": "2359341",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359341"
      },
      {
        "category": "external",
        "summary": "2359342",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359342"
      },
      {
        "category": "external",
        "summary": "2359355",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359355"
      },
      {
        "category": "external",
        "summary": "2359357",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359357"
      },
      {
        "category": "external",
        "summary": "2361962",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361962"
      },
      {
        "category": "external",
        "summary": "2361963",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361963"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4440.json"
      }
    ],
    "title": "Red Hat Security Advisory: libsoup security update",
    "tracking": {
      "current_release_date": "2026-10-16T10:56:27+00:00",
      "generator": {
        "date": "2026-10-16T10:56:27+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2025:4440",
      "initial_release_date": "2025-05-05T01:24:57+00:00",
      "revision_history": [
        {
          "date": "2025-05-05T01:24:57+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-05-05T01:24:57+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-16T10:56:27+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v.9.4)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v.9.4)",
                  "product_id": "AppStream-9.4.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus:9.4::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-0:2.72.0-8.el9_4.4.src",
                "product": {
                  "name": "libsoup-0:2.72.0-8.el9_4.4.src",
                  "product_id": "libsoup-0:2.72.0-8.el9_4.4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup@2.72.0-8.el9_4.4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-0:2.72.0-8.el9_4.4.aarch64",
                "product": {
                  "name": "libsoup-0:2.72.0-8.el9_4.4.aarch64",
                  "product_id": "libsoup-0:2.72.0-8.el9_4.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup@2.72.0-8.el9_4.4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
                "product": {
                  "name": "libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
                  "product_id": "libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-devel@2.72.0-8.el9_4.4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
                "product": {
                  "name": "libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
                  "product_id": "libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debugsource@2.72.0-8.el9_4.4?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
                "product": {
                  "name": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
                  "product_id": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debuginfo@2.72.0-8.el9_4.4?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-0:2.72.0-8.el9_4.4.ppc64le",
                "product": {
                  "name": "libsoup-0:2.72.0-8.el9_4.4.ppc64le",
                  "product_id": "libsoup-0:2.72.0-8.el9_4.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup@2.72.0-8.el9_4.4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
                "product": {
                  "name": "libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
                  "product_id": "libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-devel@2.72.0-8.el9_4.4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
                "product": {
                  "name": "libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
                  "product_id": "libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debugsource@2.72.0-8.el9_4.4?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
                "product": {
                  "name": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
                  "product_id": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debuginfo@2.72.0-8.el9_4.4?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-0:2.72.0-8.el9_4.4.i686",
                "product": {
                  "name": "libsoup-0:2.72.0-8.el9_4.4.i686",
                  "product_id": "libsoup-0:2.72.0-8.el9_4.4.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup@2.72.0-8.el9_4.4?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.72.0-8.el9_4.4.i686",
                "product": {
                  "name": "libsoup-devel-0:2.72.0-8.el9_4.4.i686",
                  "product_id": "libsoup-devel-0:2.72.0-8.el9_4.4.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-devel@2.72.0-8.el9_4.4?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
                "product": {
                  "name": "libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
                  "product_id": "libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debugsource@2.72.0-8.el9_4.4?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
                "product": {
                  "name": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
                  "product_id": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debuginfo@2.72.0-8.el9_4.4?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-0:2.72.0-8.el9_4.4.x86_64",
                "product": {
                  "name": "libsoup-0:2.72.0-8.el9_4.4.x86_64",
                  "product_id": "libsoup-0:2.72.0-8.el9_4.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup@2.72.0-8.el9_4.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.72.0-8.el9_4.4.x86_64",
                "product": {
                  "name": "libsoup-devel-0:2.72.0-8.el9_4.4.x86_64",
                  "product_id": "libsoup-devel-0:2.72.0-8.el9_4.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-devel@2.72.0-8.el9_4.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
                "product": {
                  "name": "libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
                  "product_id": "libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debugsource@2.72.0-8.el9_4.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
                "product": {
                  "name": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
                  "product_id": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debuginfo@2.72.0-8.el9_4.4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-0:2.72.0-8.el9_4.4.s390x",
                "product": {
                  "name": "libsoup-0:2.72.0-8.el9_4.4.s390x",
                  "product_id": "libsoup-0:2.72.0-8.el9_4.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup@2.72.0-8.el9_4.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
                "product": {
                  "name": "libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
                  "product_id": "libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-devel@2.72.0-8.el9_4.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
                "product": {
                  "name": "libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
                  "product_id": "libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debugsource@2.72.0-8.el9_4.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
                "product": {
                  "name": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
                  "product_id": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libsoup-debuginfo@2.72.0-8.el9_4.4?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.72.0-8.el9_4.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64"
        },
        "product_reference": "libsoup-0:2.72.0-8.el9_4.4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.72.0-8.el9_4.4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686"
        },
        "product_reference": "libsoup-0:2.72.0-8.el9_4.4.i686",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.72.0-8.el9_4.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le"
        },
        "product_reference": "libsoup-0:2.72.0-8.el9_4.4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.72.0-8.el9_4.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x"
        },
        "product_reference": "libsoup-0:2.72.0-8.el9_4.4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.72.0-8.el9_4.4.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src"
        },
        "product_reference": "libsoup-0:2.72.0-8.el9_4.4.src",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.72.0-8.el9_4.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64"
        },
        "product_reference": "libsoup-0:2.72.0-8.el9_4.4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64"
        },
        "product_reference": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686"
        },
        "product_reference": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le"
        },
        "product_reference": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x"
        },
        "product_reference": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64"
        },
        "product_reference": "libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64"
        },
        "product_reference": "libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debugsource-0:2.72.0-8.el9_4.4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686"
        },
        "product_reference": "libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le"
        },
        "product_reference": "libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x"
        },
        "product_reference": "libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64"
        },
        "product_reference": "libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.72.0-8.el9_4.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64"
        },
        "product_reference": "libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.72.0-8.el9_4.4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686"
        },
        "product_reference": "libsoup-devel-0:2.72.0-8.el9_4.4.i686",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le"
        },
        "product_reference": "libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.72.0-8.el9_4.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x"
        },
        "product_reference": "libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.72.0-8.el9_4.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
          "product_id": "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
        },
        "product_reference": "libsoup-devel-0:2.72.0-8.el9_4.4.x86_64",
        "relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-32050",
      "cwe": {
        "id": "CWE-127",
        "name": "Buffer Under-read"
      },
      "discovery_date": "2025-04-03T01:17:42.454000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2357067"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsoup: Integer overflow in append_param_quoted",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-32050"
        },
        {
          "category": "external",
          "summary": "RHBZ#2357067",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357067"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-32050",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-32050"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32050",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32050"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/424",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/424"
        }
      ],
      "release_date": "2025-04-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-05T01:24:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:4440"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available for this vulnerability.",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libsoup: Integer overflow in append_param_quoted"
    },
    {
      "cve": "CVE-2025-32052",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "discovery_date": "2025-04-03T01:16:47.177000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2357069"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsoup: Heap buffer overflow in sniff_unknown()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate severity heap buffer over-read flaw was found in the libsoup content sniffer, in the sniff_unknown() function of soup-content-sniffer.c. A remote attacker who controls an HTTP server can send a crafted HTTP response to a client application using libsoup, causing the content sniffer to read beyond the bounds of a heap-allocated buffer when determining the content type. This out-of-bounds read can lead to disclosure of information from process memory or cause the client application to crash, consistent with the Red Hat severity rating of Moderate (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), which matches the upstream rating. Red Hat Enterprise Linux 8 and 9 (libsoup), Red Hat In-Vehicle OS (libsoup), and products shipping the mingw-libsoup variant are affected, and a fix is being pursued through the respective product streams. Red Hat Enterprise Linux 10 is not affected because the vulnerable code is not present in its libsoup3 packages.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-32052"
        },
        {
          "category": "external",
          "summary": "RHBZ#2357069",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357069"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-32052",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-32052"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32052",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32052"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/425",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/425"
        }
      ],
      "release_date": "2025-04-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-05T01:24:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:4440"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available for this vulnerability.",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libsoup: Heap buffer overflow in sniff_unknown()"
    },
    {
      "cve": "CVE-2025-32053",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "discovery_date": "2025-04-03T01:16:47.321000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2357070"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsoup: Heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate severity vulnerability was found in libsoup, where heap buffer over-reads can occur in the content sniffer\u0027s sniff_feed_or_html() and skip_insignificant_space() functions. A remote attacker who controls an HTTP server that a libsoup-based client connects to could send a crafted HTTP response that causes the client to read out of bounds, potentially resulting in a crash or exposure of out-of-bounds heap memory contents. Red Hat has rated this flaw Moderate severity with a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), consistent with the upstream assessment. The libsoup package as shipped in Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat In-Vehicle OS is affected, and fixes are being pursued through the respective product maintenance streams. Red Hat Enterprise Linux 10, which ships the libsoup3 package, is not affected because the vulnerable code is not present in that version.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-32053"
        },
        {
          "category": "external",
          "summary": "RHBZ#2357070",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357070"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-32053",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-32053"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32053",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32053"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/426",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/426"
        }
      ],
      "release_date": "2025-04-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-05T01:24:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:4440"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available for this vulnerability.",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libsoup: Heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space()"
    },
    {
      "cve": "CVE-2025-32906",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2025-04-14T01:27:05.130000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2359341"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsoup: Out of bounds reads in soup_headers_parse_request()",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-32906"
        },
        {
          "category": "external",
          "summary": "RHBZ#2359341",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359341"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-32906",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-32906"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32906",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32906"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/404",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/404"
        }
      ],
      "release_date": "2025-04-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-05T01:24:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:4440"
        },
        {
          "category": "workaround",
          "details": "Currently, no mitigation was found for this vulnerability.",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libsoup: Out of bounds reads in soup_headers_parse_request()"
    },
    {
      "cve": "CVE-2025-32907",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2025-04-14T01:27:08.699000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2359342"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsoup: Denial of service in server when client requests a large amount of  overlapping ranges with Range header",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-32907"
        },
        {
          "category": "external",
          "summary": "RHBZ#2359342",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359342"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-32907",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-32907"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32907",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32907"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/428",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/428"
        }
      ],
      "release_date": "2025-04-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-05T01:24:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:4440"
        },
        {
          "category": "workaround",
          "details": "Currently, no mitigation was found for this vulnerability.",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libsoup: Denial of service in server when client requests a large amount of  overlapping ranges with Range header"
    },
    {
      "cve": "CVE-2025-32911",
      "cwe": {
        "id": "CWE-590",
        "name": "Free of Memory not on the Heap"
      },
      "discovery_date": "2025-04-14T01:21:00.518000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2359355"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsoup: Double free on  soup_message_headers_get_content_disposition() through  \"soup-message-headers.c\" via \"params\" GHashTable value",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-32911"
        },
        {
          "category": "external",
          "summary": "RHBZ#2359355",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359355"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-32911",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-32911"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32911",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32911"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/433",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/433"
        }
      ],
      "release_date": "2025-04-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-05T01:24:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:4440"
        },
        {
          "category": "workaround",
          "details": "Currently, no mitigation is available for this vulnerability.",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.0,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libsoup: Double free on  soup_message_headers_get_content_disposition() through  \"soup-message-headers.c\" via \"params\" GHashTable value"
    },
    {
      "cve": "CVE-2025-32913",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2025-04-14T01:21:01.010000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2359357"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client or server that uses this function.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsoup: NULL pointer dereference in  soup_message_headers_get_content_disposition when \"filename\" parameter  is present, but has no value in Content-Disposition header",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-32913"
        },
        {
          "category": "external",
          "summary": "RHBZ#2359357",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359357"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-32913",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-32913"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32913",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32913"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/435",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/435"
        }
      ],
      "release_date": "2025-04-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-05T01:24:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:4440"
        },
        {
          "category": "workaround",
          "details": "Currently, no mitigation is available for this vulnerability.",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libsoup: NULL pointer dereference in  soup_message_headers_get_content_disposition when \"filename\" parameter  is present, but has no value in Content-Disposition header"
    },
    {
      "cve": "CVE-2025-46420",
      "cwe": {
        "id": "CWE-401",
        "name": "Missing Release of Memory after Effective Lifetime"
      },
      "discovery_date": "2025-04-24T01:33:03.009000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2361963"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libsoup. It is vulnerable to memory leaks in the soup_header_parse_quality_list() function when parsing a quality list that contains elements with all zeroes.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsoup: Memory leak on soup_header_parse_quality_list() via soup-headers.c",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate impact memory leak flaw was found in libsoup. When the soup_header_parse_quality_list() function in soup-headers.c parses a quality list in which any element\u0027s quality value consists entirely of zeroes (for example q=0, q=0.0, or q=0.000), the parsed elements are not freed and memory is leaked in proportion to the size of the crafted values, which may carry a large number of trailing zeroes. A remote attacker able to have an application using libsoup parse such crafted HTTP quality-list headers could trigger this leak repeatedly, eventually exhausting available memory and causing a denial of service. The affected libsoup packages ship in Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 9, where fixes have been delivered through the respective update streams, and in Red Hat In-Vehicle OS, where the fix is being pursued through the platform\u0027s update process. Red Hat Enterprise Linux 10 ships libsoup3, which does not contain the vulnerable code and is therefore not affected. The Red Hat severity rating (Moderate, CVSS 6.5) is consistent with the upstream rating.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-46420"
        },
        {
          "category": "external",
          "summary": "RHBZ#2361963",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361963"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-46420",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-46420"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-46420",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46420"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/438",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/438"
        }
      ],
      "release_date": "2025-04-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-05T01:24:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:4440"
        },
        {
          "category": "workaround",
          "details": "Currently, no mitigation is available for this vulnerability.",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libsoup: Memory leak on soup_header_parse_quality_list() via soup-headers.c"
    },
    {
      "cve": "CVE-2025-46421",
      "cwe": {
        "id": "CWE-497",
        "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere"
      },
      "discovery_date": "2025-04-24T01:35:00.884000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2361962"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate-severity information disclosure flaw was found in libsoup, affecting the libsoup and libsoup3 components as shipped in Red Hat Enterprise Linux 8, 9, and 10, and Red Hat In-Vehicle OS, with the issue delegated to the Fedora community for community-project packages. When a libsoup-based client follows an HTTP redirect, it mistakenly sends the HTTP Authorization header to the new host that the redirect points to. This allows the host that is the target of the redirection to capture the client\u0027s credentials and impersonate the user to the original host that issued the redirect. Exploitation requires network access with high attack complexity, no privileges, and user interaction, and affects the confidentiality and integrity of the authenticated session but not availability. Red Hat and the upstream CVE record both assess this flaw with a CVSS score of 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N), so the Red Hat severity matches upstream. A fix for the affected Red Hat products is being pursued.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
          "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
          "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-46421"
        },
        {
          "category": "external",
          "summary": "RHBZ#2361962",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361962"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-46421",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-46421"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-46421",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46421"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/439",
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/439"
        }
      ],
      "release_date": "2025-04-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-05T01:24:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:4440"
        },
        {
          "category": "workaround",
          "details": "Currently, no mitigation is available for this vulnerability.",
          "product_ids": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.src",
            "AppStream-9.4.0.Z.EUS:libsoup-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debuginfo-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-debugsource-0:2.72.0-8.el9_4.4.x86_64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.aarch64",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.i686",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.ppc64le",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.s390x",
            "AppStream-9.4.0.Z.EUS:libsoup-devel-0:2.72.0-8.el9_4.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.