RHSA-2025:4439HighCVSS 9.0

Red Hat Security Advisory: libsoup security update

Published
May 5, 2025
Last Modified
November 5, 2026

🔗 CVE IDs covered (6)

CVE-2025-46421 →CVE-2025-32906 →CVE-2025-32907 →CVE-2025-32911 →CVE-2025-32913 →CVE-2025-46420 →

📋 Description

CVE-2025-32906 — libsoup: Out of bounds reads in soup_headers_parse_request() CVE-2025-32907 — libsoup: Denial of service in server when client requests a large amount of overlapping ranges with Range header CVE-2025-32911 — libsoup: Double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" GHashTable value CVE-2025-32913 — libsoup: NULL pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in Content-Disposition header CVE-2025-46420 — libsoup: Memory leak on soup_header_parse_quality_list() via soup-headers.c CVE-2025-46421 — libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server

🎯 Affected products22

  • Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-0:2.72.0-8.el9_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-0:2.72.0-8.el9_0.4.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-0:2.72.0-8.el9_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-0:2.72.0-8.el9_0.4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-0:2.72.0-8.el9_0.4.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-0:2.72.0-8.el9_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-debuginfo-0:2.72.0-8.el9_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-debuginfo-0:2.72.0-8.el9_0.4.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-debuginfo-0:2.72.0-8.el9_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-debuginfo-0:2.72.0-8.el9_0.4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-debuginfo-0:2.72.0-8.el9_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-debugsource-0:2.72.0-8.el9_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-debugsource-0:2.72.0-8.el9_0.4.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-debugsource-0:2.72.0-8.el9_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-debugsource-0:2.72.0-8.el9_0.4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-debugsource-0:2.72.0-8.el9_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-devel-0:2.72.0-8.el9_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-devel-0:2.72.0-8.el9_0.4.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-devel-0:2.72.0-8.el9_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-devel-0:2.72.0-8.el9_0.4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • libsoup-devel-0:2.72.0-8.el9_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Currently, no mitigation was found for this vulnerability. Workaround: Currently, no mitigation is available for this vulnerability.

🔗 References (9)