RHSA-2025:7505HighCVSS 7.5

Red Hat Security Advisory: libsoup3 security update

Published
May 13, 2025
Last Modified
November 5, 2026

🔗 CVE IDs covered (6)

CVE-2025-32908 →CVE-2025-32912 →CVE-2025-32914 →CVE-2025-46421 →CVE-2025-2784 →CVE-2025-32906 →

📋 Description

CVE-2025-2784 — libsoup: Heap buffer over-read in skip_insignificant_space when sniffing content CVE-2025-32906 — libsoup: Out of bounds reads in soup_headers_parse_request() CVE-2025-32908 — libsoup: Denial of service on libsoup through HTTP/2 server CVE-2025-32912 — libsoup: NULL pointer dereference in client when server omits the "nonce" parameter in an Unauthorized response with Digest authentication CVE-2025-32914 — libsoup: OOB Read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process CVE-2025-46421 — libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server

🎯 Affected products20

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • libsoup3-0:3.6.5-3.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-0:3.6.5-3.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-0:3.6.5-3.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-0:3.6.5-3.el10_0.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-0:3.6.5-3.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-debugsource-0:3.6.5-3.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-devel-0:3.6.5-3.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-devel-0:3.6.5-3.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-devel-0:3.6.5-3.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-devel-0:3.6.5-3.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-doc-0:3.6.5-3.el10_0.noarch as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Currently no mitigation is available for this vulnerability. Workaround: Currently, no mitigation was found for this vulnerability. Workaround: Currently, no mitigation is available for this vulnerability.

🔗 References (11)