RHSA-2025:7505
Vulnerability from csaf_redhat - Published: 2025-05-13 15:59 - Updated: 2026-10-16 10:56Summary
Red Hat Security Advisory: libsoup3 security update
Severity
Important
Notes
Topic: An update for libsoup3 is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.
Security Fix(es):
* libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784)
* libsoup: Out of bounds reads in soup_headers_parse_request() (CVE-2025-32906)
* libsoup: Denial of service on libsoup through HTTP/2 server (CVE-2025-32908)
* libsoup: NULL pointer dereference in client when server omits the "nonce" parameter in an Unauthorized response with Digest authentication (CVE-2025-32912)
* libsoup: OOB Read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process (CVE-2025-32914)
* libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server (CVE-2025-46421)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.
7.0 (High)
Affected products
Fixed
18 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server.
7.5 (High)
Affected products
Fixed
18 products, the same list as for
CVE-2025-2784
Threats
Impact
Important
A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS).
7.5 (High)
Affected products
Fixed
18 products, the same list as for
CVE-2025-2784
Threats
Impact
Important
A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash.
6.5 (Medium)
Affected products
Fixed
18 products, the same list as for
CVE-2025-2784
Threats
Impact
Moderate
A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds.
7.4 (High)
Affected products
Fixed
18 products, the same list as for
CVE-2025-2784
Threats
Impact
Moderate
A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.
6.8 (Medium)
Affected products
Fixed
18 products, the same list as for
CVE-2025-2784
Threats
Impact
Moderate
References
42 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for libsoup3 is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.\n\nSecurity Fix(es):\n\n* libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784)\n\n* libsoup: Out of bounds reads in soup_headers_parse_request() (CVE-2025-32906)\n\n* libsoup: Denial of service on libsoup through HTTP/2 server (CVE-2025-32908)\n\n* libsoup: NULL pointer dereference in client when server omits the \"nonce\" parameter in an Unauthorized response with Digest authentication (CVE-2025-32912)\n\n* libsoup: OOB Read on libsoup through function \"soup_multipart_new_from_message\" in soup-multipart.c leads to crash or exit of process (CVE-2025-32914)\n\n* libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server (CVE-2025-46421)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:7505",
"url": "https://access.redhat.com/errata/RHSA-2025:7505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2354669",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2354669"
},
{
"category": "external",
"summary": "2359341",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359341"
},
{
"category": "external",
"summary": "2359343",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359343"
},
{
"category": "external",
"summary": "2359356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359356"
},
{
"category": "external",
"summary": "2359358",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359358"
},
{
"category": "external",
"summary": "2361962",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361962"
},
{
"category": "external",
"summary": "RHEL-65395",
"url": "https://issues.redhat.com/browse/RHEL-65395"
},
{
"category": "external",
"summary": "RHEL-84737",
"url": "https://issues.redhat.com/browse/RHEL-84737"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7505.json"
}
],
"title": "Red Hat Security Advisory: libsoup3 security update",
"tracking": {
"current_release_date": "2026-10-16T10:56:25+00:00",
"generator": {
"date": "2026-10-16T10:56:25+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.2"
}
},
"id": "RHSA-2025:7505",
"initial_release_date": "2025-05-13T15:59:34+00:00",
"revision_history": [
{
"date": "2025-05-13T15:59:34+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-05-13T15:59:34+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-16T10:56:25+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.0"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "libsoup3-0:3.6.5-3.el10_0.src",
"product": {
"name": "libsoup3-0:3.6.5-3.el10_0.src",
"product_id": "libsoup3-0:3.6.5-3.el10_0.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3@3.6.5-3.el10_0?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "libsoup3-0:3.6.5-3.el10_0.aarch64",
"product": {
"name": "libsoup3-0:3.6.5-3.el10_0.aarch64",
"product_id": "libsoup3-0:3.6.5-3.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3@3.6.5-3.el10_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"product": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"product_id": "libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-devel@3.6.5-3.el10_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"product": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"product_id": "libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-debugsource@3.6.5-3.el10_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"product": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"product_id": "libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-debuginfo@3.6.5-3.el10_0?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libsoup3-0:3.6.5-3.el10_0.ppc64le",
"product": {
"name": "libsoup3-0:3.6.5-3.el10_0.ppc64le",
"product_id": "libsoup3-0:3.6.5-3.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3@3.6.5-3.el10_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"product": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"product_id": "libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-devel@3.6.5-3.el10_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"product": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"product_id": "libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-debugsource@3.6.5-3.el10_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"product": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"product_id": "libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-debuginfo@3.6.5-3.el10_0?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libsoup3-0:3.6.5-3.el10_0.x86_64",
"product": {
"name": "libsoup3-0:3.6.5-3.el10_0.x86_64",
"product_id": "libsoup3-0:3.6.5-3.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3@3.6.5-3.el10_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"product": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"product_id": "libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-devel@3.6.5-3.el10_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"product": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"product_id": "libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-debugsource@3.6.5-3.el10_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"product": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"product_id": "libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-debuginfo@3.6.5-3.el10_0?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "libsoup3-0:3.6.5-3.el10_0.s390x",
"product": {
"name": "libsoup3-0:3.6.5-3.el10_0.s390x",
"product_id": "libsoup3-0:3.6.5-3.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3@3.6.5-3.el10_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"product": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"product_id": "libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-devel@3.6.5-3.el10_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"product": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"product_id": "libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-debugsource@3.6.5-3.el10_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"product": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"product_id": "libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-debuginfo@3.6.5-3.el10_0?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"product": {
"name": "libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"product_id": "libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-doc@3.6.5-3.el10_0?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-0:3.6.5-3.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64"
},
"product_reference": "libsoup3-0:3.6.5-3.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-0:3.6.5-3.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le"
},
"product_reference": "libsoup3-0:3.6.5-3.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-0:3.6.5-3.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x"
},
"product_reference": "libsoup3-0:3.6.5-3.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-0:3.6.5-3.el10_0.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src"
},
"product_reference": "libsoup3-0:3.6.5-3.el10_0.src",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-0:3.6.5-3.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64"
},
"product_reference": "libsoup3-0:3.6.5-3.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64"
},
"product_reference": "libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le"
},
"product_reference": "libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x"
},
"product_reference": "libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64"
},
"product_reference": "libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64"
},
"product_reference": "libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le"
},
"product_reference": "libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x"
},
"product_reference": "libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64"
},
"product_reference": "libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64"
},
"product_reference": "libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le"
},
"product_reference": "libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x"
},
"product_reference": "libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64"
},
"product_reference": "libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-doc-0:3.6.5-3.el10_0.noarch as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
},
"product_reference": "libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"relates_to_product_reference": "CRB-10.0.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-2784",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2025-03-25T01:57:31.752000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2354669"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this with a Moderate impact as the flaw may be targeting Confidentiality and Integrity specific to each request.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-2784"
},
{
"category": "external",
"summary": "RHBZ#2354669",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2354669"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-2784",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-2784"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-2784",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2784"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/422",
"url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/422"
}
],
"release_date": "2025-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T15:59:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7505"
},
{
"category": "workaround",
"details": "Currently no mitigation is available for this vulnerability.",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content"
},
{
"cve": "CVE-2025-32906",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2025-04-14T01:27:05.130000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2359341"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libsoup: Out of bounds reads in soup_headers_parse_request()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-32906"
},
{
"category": "external",
"summary": "RHBZ#2359341",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359341"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-32906",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32906"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32906",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32906"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/404",
"url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/404"
}
],
"release_date": "2025-04-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T15:59:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7505"
},
{
"category": "workaround",
"details": "Currently, no mitigation was found for this vulnerability.",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libsoup: Out of bounds reads in soup_headers_parse_request()"
},
{
"cve": "CVE-2025-32908",
"cwe": {
"id": "CWE-115",
"name": "Misinterpretation of Input"
},
"discovery_date": "2025-04-14T01:27:09.097000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2359343"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libsoup: Denial of service on libsoup through HTTP/2 server",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-32908"
},
{
"category": "external",
"summary": "RHBZ#2359343",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359343"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-32908",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32908"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32908",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32908"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/429",
"url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/429"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/451",
"url": "https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/451"
}
],
"release_date": "2025-04-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T15:59:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7505"
},
{
"category": "workaround",
"details": "Currently, no mitigation was found for this vulnerability.",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libsoup: Denial of service on libsoup through HTTP/2 server"
},
{
"cve": "CVE-2025-32912",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2025-04-14T01:21:00.709000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2359356"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libsoup: NULL pointer dereference in client when server omits the \"nonce\" parameter in an Unauthorized response with Digest authentication",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A NULL pointer dereference flaw of moderate severity was found in libsoup\u0027s SoupAuthDigest HTTP Digest authentication handling, affecting libsoup as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. When a libsoup-based client uses Digest authentication and receives an Unauthorized response in which a malicious or compromised HTTP server omits the required \"nonce\" parameter, the client crashes. This is a client-side denial of service only; confidentiality and integrity are not affected, and exploitation requires the user to connect to an attacker-controlled server. Red Hat\u0027s severity rating (MODERATE, CVSS 6.5) matches the upstream assessment. The fix has been deferred for libsoup in Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat In-Vehicle OS 1, where the residual risk is limited to a crash of the affected client application when it connects to a malicious server; a fix is being pursued for libsoup3 in Red Hat Enterprise Linux 10 and for libsoup in Fedora through the community process. The legacy libsoup component in Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support is out of support scope, and the mingw-libsoup component in Red Hat Build of RHEL 8 will not be fixed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-32912"
},
{
"category": "external",
"summary": "RHBZ#2359356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-32912",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32912"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32912",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32912"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/434",
"url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/434"
}
],
"release_date": "2025-04-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T15:59:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7505"
},
{
"category": "workaround",
"details": "Currently, no mitigation is available for this vulnerability.",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libsoup: NULL pointer dereference in client when server omits the \"nonce\" parameter in an Unauthorized response with Digest authentication"
},
{
"cve": "CVE-2025-32914",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2025-04-14T01:21:01.384000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2359358"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libsoup: OOB Read on libsoup through function \"soup_multipart_new_from_message\" in soup-multipart.c leads to crash or exit of process",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw of moderate impact was found in libsoup, where the soup_multipart_new_from_message() function in soup-multipart.c performs an out-of-bounds read. A remote malicious HTTP client can send a crafted multipart message that causes a libsoup-based server to read out of bounds while parsing it, which can crash or terminate the affected process, resulting in denial of service; the Red Hat CVSS 3.1 vector for this flaw (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H, base score 7.4) also reflects potential exposure of out-of-bounds memory in addition to the availability impact. Although the 7.4 base score maps to an IMPORTANT CVSS severity, Red Hat Product Security has curated the impact of this flaw as MODERATE. The libsoup, libsoup3, and mingw-libsoup components in Red Hat Enterprise Linux 7, 8, 9, and 10, in Red Hat In-Vehicle OS 1, and in Fedora are listed as affected, and a fix is being pursued through the delegated maintainers for each affected stream; the libsoup component in Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope and no update is planned for that stream.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-32914"
},
{
"category": "external",
"summary": "RHBZ#2359358",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359358"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-32914",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32914"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32914",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32914"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/436",
"url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/436"
}
],
"release_date": "2025-04-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T15:59:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7505"
},
{
"category": "workaround",
"details": "Currently, no mitigation is available for this vulnerability.",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libsoup: OOB Read on libsoup through function \"soup_multipart_new_from_message\" in soup-multipart.c leads to crash or exit of process"
},
{
"cve": "CVE-2025-46421",
"cwe": {
"id": "CWE-497",
"name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere"
},
"discovery_date": "2025-04-24T01:35:00.884000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2361962"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A moderate-severity information disclosure flaw was found in libsoup, affecting the libsoup and libsoup3 components as shipped in Red Hat Enterprise Linux 8, 9, and 10, and Red Hat In-Vehicle OS, with the issue delegated to the Fedora community for community-project packages. When a libsoup-based client follows an HTTP redirect, it mistakenly sends the HTTP Authorization header to the new host that the redirect points to. This allows the host that is the target of the redirection to capture the client\u0027s credentials and impersonate the user to the original host that issued the redirect. Exploitation requires network access with high attack complexity, no privileges, and user interaction, and affects the confidentiality and integrity of the authenticated session but not availability. Red Hat and the upstream CVE record both assess this flaw with a CVSS score of 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N), so the Red Hat severity matches upstream. A fix for the affected Red Hat products is being pursued.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-46421"
},
{
"category": "external",
"summary": "RHBZ#2361962",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361962"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-46421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-46421"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-46421",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46421"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/439",
"url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/439"
}
],
"release_date": "2025-04-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T15:59:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7505"
},
{
"category": "workaround",
"details": "Currently, no mitigation is available for this vulnerability.",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.