rhsa-2025:7505
Vulnerability from csaf_redhat
Published
2025-05-13 15:59
Modified
2025-07-29 08:16
Summary
Red Hat Security Advisory: libsoup3 security update
Notes
Topic
An update for libsoup3 is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.
Security Fix(es):
* libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784)
* libsoup: Out of bounds reads in soup_headers_parse_request() (CVE-2025-32906)
* libsoup: Denial of service on libsoup through HTTP/2 server (CVE-2025-32908)
* libsoup: NULL pointer dereference in client when server omits the "nonce" parameter in an Unauthorized response with Digest authentication (CVE-2025-32912)
* libsoup: OOB Read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process (CVE-2025-32914)
* libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server (CVE-2025-46421)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for libsoup3 is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.\n\nSecurity Fix(es):\n\n* libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784)\n\n* libsoup: Out of bounds reads in soup_headers_parse_request() (CVE-2025-32906)\n\n* libsoup: Denial of service on libsoup through HTTP/2 server (CVE-2025-32908)\n\n* libsoup: NULL pointer dereference in client when server omits the \"nonce\" parameter in an Unauthorized response with Digest authentication (CVE-2025-32912)\n\n* libsoup: OOB Read on libsoup through function \"soup_multipart_new_from_message\" in soup-multipart.c leads to crash or exit of process (CVE-2025-32914)\n\n* libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server (CVE-2025-46421)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:7505",
"url": "https://access.redhat.com/errata/RHSA-2025:7505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2354669",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2354669"
},
{
"category": "external",
"summary": "2359341",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359341"
},
{
"category": "external",
"summary": "2359343",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359343"
},
{
"category": "external",
"summary": "2359356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359356"
},
{
"category": "external",
"summary": "2359358",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359358"
},
{
"category": "external",
"summary": "2361962",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361962"
},
{
"category": "external",
"summary": "RHEL-65395",
"url": "https://issues.redhat.com/browse/RHEL-65395"
},
{
"category": "external",
"summary": "RHEL-84737",
"url": "https://issues.redhat.com/browse/RHEL-84737"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7505.json"
}
],
"title": "Red Hat Security Advisory: libsoup3 security update",
"tracking": {
"current_release_date": "2025-07-29T08:16:42+00:00",
"generator": {
"date": "2025-07-29T08:16:42+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.4"
}
},
"id": "RHSA-2025:7505",
"initial_release_date": "2025-05-13T15:59:34+00:00",
"revision_history": [
{
"date": "2025-05-13T15:59:34+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-05-13T15:59:34+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-07-29T08:16:42+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.0"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "libsoup3-0:3.6.5-3.el10_0.src",
"product": {
"name": "libsoup3-0:3.6.5-3.el10_0.src",
"product_id": "libsoup3-0:3.6.5-3.el10_0.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3@3.6.5-3.el10_0?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "libsoup3-0:3.6.5-3.el10_0.aarch64",
"product": {
"name": "libsoup3-0:3.6.5-3.el10_0.aarch64",
"product_id": "libsoup3-0:3.6.5-3.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3@3.6.5-3.el10_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"product": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"product_id": "libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-devel@3.6.5-3.el10_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"product": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"product_id": "libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-debugsource@3.6.5-3.el10_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"product": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"product_id": "libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-debuginfo@3.6.5-3.el10_0?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libsoup3-0:3.6.5-3.el10_0.ppc64le",
"product": {
"name": "libsoup3-0:3.6.5-3.el10_0.ppc64le",
"product_id": "libsoup3-0:3.6.5-3.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3@3.6.5-3.el10_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"product": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"product_id": "libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-devel@3.6.5-3.el10_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"product": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"product_id": "libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-debugsource@3.6.5-3.el10_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"product": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"product_id": "libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-debuginfo@3.6.5-3.el10_0?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libsoup3-0:3.6.5-3.el10_0.x86_64",
"product": {
"name": "libsoup3-0:3.6.5-3.el10_0.x86_64",
"product_id": "libsoup3-0:3.6.5-3.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3@3.6.5-3.el10_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"product": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"product_id": "libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-devel@3.6.5-3.el10_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"product": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"product_id": "libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-debugsource@3.6.5-3.el10_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"product": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"product_id": "libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-debuginfo@3.6.5-3.el10_0?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "libsoup3-0:3.6.5-3.el10_0.s390x",
"product": {
"name": "libsoup3-0:3.6.5-3.el10_0.s390x",
"product_id": "libsoup3-0:3.6.5-3.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3@3.6.5-3.el10_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"product": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"product_id": "libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-devel@3.6.5-3.el10_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"product": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"product_id": "libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-debugsource@3.6.5-3.el10_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"product": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"product_id": "libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-debuginfo@3.6.5-3.el10_0?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"product": {
"name": "libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"product_id": "libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libsoup3-doc@3.6.5-3.el10_0?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-0:3.6.5-3.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64"
},
"product_reference": "libsoup3-0:3.6.5-3.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-0:3.6.5-3.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le"
},
"product_reference": "libsoup3-0:3.6.5-3.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-0:3.6.5-3.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x"
},
"product_reference": "libsoup3-0:3.6.5-3.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-0:3.6.5-3.el10_0.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src"
},
"product_reference": "libsoup3-0:3.6.5-3.el10_0.src",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-0:3.6.5-3.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64"
},
"product_reference": "libsoup3-0:3.6.5-3.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64"
},
"product_reference": "libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le"
},
"product_reference": "libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x"
},
"product_reference": "libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64"
},
"product_reference": "libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64"
},
"product_reference": "libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le"
},
"product_reference": "libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x"
},
"product_reference": "libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64"
},
"product_reference": "libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64"
},
"product_reference": "libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le"
},
"product_reference": "libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x"
},
"product_reference": "libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64"
},
"product_reference": "libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-doc-0:3.6.5-3.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
},
"product_reference": "libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-0:3.6.5-3.el10_0.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64"
},
"product_reference": "libsoup3-0:3.6.5-3.el10_0.aarch64",
"relates_to_product_reference": "CRB-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-0:3.6.5-3.el10_0.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le"
},
"product_reference": "libsoup3-0:3.6.5-3.el10_0.ppc64le",
"relates_to_product_reference": "CRB-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-0:3.6.5-3.el10_0.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x"
},
"product_reference": "libsoup3-0:3.6.5-3.el10_0.s390x",
"relates_to_product_reference": "CRB-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-0:3.6.5-3.el10_0.src as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src"
},
"product_reference": "libsoup3-0:3.6.5-3.el10_0.src",
"relates_to_product_reference": "CRB-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-0:3.6.5-3.el10_0.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64"
},
"product_reference": "libsoup3-0:3.6.5-3.el10_0.x86_64",
"relates_to_product_reference": "CRB-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64"
},
"product_reference": "libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"relates_to_product_reference": "CRB-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le"
},
"product_reference": "libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"relates_to_product_reference": "CRB-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x"
},
"product_reference": "libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"relates_to_product_reference": "CRB-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64"
},
"product_reference": "libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"relates_to_product_reference": "CRB-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64"
},
"product_reference": "libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"relates_to_product_reference": "CRB-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le"
},
"product_reference": "libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"relates_to_product_reference": "CRB-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x"
},
"product_reference": "libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"relates_to_product_reference": "CRB-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64"
},
"product_reference": "libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"relates_to_product_reference": "CRB-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64"
},
"product_reference": "libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"relates_to_product_reference": "CRB-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le"
},
"product_reference": "libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"relates_to_product_reference": "CRB-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x"
},
"product_reference": "libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"relates_to_product_reference": "CRB-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-devel-0:3.6.5-3.el10_0.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64"
},
"product_reference": "libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"relates_to_product_reference": "CRB-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libsoup3-doc-0:3.6.5-3.el10_0.noarch as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"product_id": "CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
},
"product_reference": "libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"relates_to_product_reference": "CRB-10.0.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-2784",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2025-03-25T01:57:31.752000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2354669"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this with a Moderate impact as the flaw may be targeting Confidentiality and Integrity specific to each request.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-2784"
},
{
"category": "external",
"summary": "RHBZ#2354669",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2354669"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-2784",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-2784"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-2784",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2784"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/422",
"url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/422"
}
],
"release_date": "2025-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T15:59:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7505"
},
{
"category": "workaround",
"details": "Currently no mitigation is available for this vulnerability.",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content"
},
{
"cve": "CVE-2025-32906",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2025-04-14T01:27:05.130000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2359341"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libsoup: Out of bounds reads in soup_headers_parse_request()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-32906"
},
{
"category": "external",
"summary": "RHBZ#2359341",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359341"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-32906",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32906"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32906",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32906"
}
],
"release_date": "2025-04-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T15:59:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7505"
},
{
"category": "workaround",
"details": "Currently, no mitigation was found for this vulnerability.",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libsoup: Out of bounds reads in soup_headers_parse_request()"
},
{
"cve": "CVE-2025-32908",
"cwe": {
"id": "CWE-115",
"name": "Misinterpretation of Input"
},
"discovery_date": "2025-04-14T01:27:09.097000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2359343"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libsoup: Denial of service on libsoup through HTTP/2 server",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-32908"
},
{
"category": "external",
"summary": "RHBZ#2359343",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359343"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-32908",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32908"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32908",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32908"
}
],
"release_date": "2025-04-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T15:59:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7505"
},
{
"category": "workaround",
"details": "Currently, no mitigation was found for this vulnerability.",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libsoup: Denial of service on libsoup through HTTP/2 server"
},
{
"cve": "CVE-2025-32912",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2025-04-14T01:21:00.709000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2359356"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libsoup: NULL pointer dereference in client when server omits the \"nonce\" parameter in an Unauthorized response with Digest authentication",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-32912"
},
{
"category": "external",
"summary": "RHBZ#2359356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-32912",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32912"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32912",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32912"
}
],
"release_date": "2025-04-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T15:59:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7505"
},
{
"category": "workaround",
"details": "Currently, no mitigation is available for this vulnerability.",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libsoup: NULL pointer dereference in client when server omits the \"nonce\" parameter in an Unauthorized response with Digest authentication"
},
{
"cve": "CVE-2025-32914",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2025-04-14T01:21:01.384000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2359358"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libsoup: OOB Read on libsoup through function \"soup_multipart_new_from_message\" in soup-multipart.c leads to crash or exit of process",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-32914"
},
{
"category": "external",
"summary": "RHBZ#2359358",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359358"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-32914",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32914"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-32914",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32914"
}
],
"release_date": "2025-04-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T15:59:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7505"
},
{
"category": "workaround",
"details": "Currently, no mitigation is available for this vulnerability.",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libsoup: OOB Read on libsoup through function \"soup_multipart_new_from_message\" in soup-multipart.c leads to crash or exit of process"
},
{
"cve": "CVE-2025-46421",
"cwe": {
"id": "CWE-497",
"name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere"
},
"discovery_date": "2025-04-24T01:35:00.884000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2361962"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-46421"
},
{
"category": "external",
"summary": "RHBZ#2361962",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361962"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-46421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-46421"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-46421",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46421"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/439",
"url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/439"
}
],
"release_date": "2025-04-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T15:59:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7505"
},
{
"category": "workaround",
"details": "Currently, no mitigation is available for this vulnerability.",
"product_ids": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"AppStream-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"AppStream-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"AppStream-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.src",
"CRB-10.0.Z:libsoup3-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debuginfo-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-debugsource-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.aarch64",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.ppc64le",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.s390x",
"CRB-10.0.Z:libsoup3-devel-0:3.6.5-3.el10_0.x86_64",
"CRB-10.0.Z:libsoup3-doc-0:3.6.5-3.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…