RHSA-2025:7436HighCVSS 9.0

Red Hat Security Advisory: libsoup security update

Published
May 13, 2025
Last Modified
November 5, 2026

🔗 CVE IDs covered (9)

CVE-2025-32906 →CVE-2025-32911 →CVE-2025-46421 →CVE-2025-32050 →CVE-2025-32052 →CVE-2025-32053 →CVE-2025-32907 →CVE-2025-32913 →CVE-2025-46420 →

📋 Description

CVE-2025-32050 — libsoup: Integer overflow in append_param_quoted CVE-2025-32052 — libsoup: Heap buffer overflow in sniff_unknown() CVE-2025-32053 — libsoup: Heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space() CVE-2025-32906 — libsoup: Out of bounds reads in soup_headers_parse_request() CVE-2025-32907 — libsoup: Denial of service in server when client requests a large amount of overlapping ranges with Range header CVE-2025-32911 — libsoup: Double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" GHashTable value CVE-2025-32913 — libsoup: NULL pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in Content-Disposition header CVE-2025-46420 — libsoup: Memory leak on soup_header_parse_quality_list() via soup-headers.c CVE-2025-46421 — libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server

🎯 Affected products22

  • Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-0:2.72.0-10.el9_6.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-0:2.72.0-10.el9_6.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-0:2.72.0-10.el9_6.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-0:2.72.0-10.el9_6.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-0:2.72.0-10.el9_6.1.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-0:2.72.0-10.el9_6.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-debuginfo-0:2.72.0-10.el9_6.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-debuginfo-0:2.72.0-10.el9_6.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-debuginfo-0:2.72.0-10.el9_6.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-debuginfo-0:2.72.0-10.el9_6.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-debuginfo-0:2.72.0-10.el9_6.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-debugsource-0:2.72.0-10.el9_6.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-debugsource-0:2.72.0-10.el9_6.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-debugsource-0:2.72.0-10.el9_6.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-debugsource-0:2.72.0-10.el9_6.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-debugsource-0:2.72.0-10.el9_6.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-devel-0:2.72.0-10.el9_6.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-devel-0:2.72.0-10.el9_6.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-devel-0:2.72.0-10.el9_6.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-devel-0:2.72.0-10.el9_6.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libsoup-devel-0:2.72.0-10.el9_6.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: No mitigation is currently available for this vulnerability. Workaround: Currently, no mitigation was found for this vulnerability. Workaround: Currently, no mitigation is available for this vulnerability.

🔗 References (12)