RHSA-2025:4538HighCVSS 9.0

Red Hat Security Advisory: libsoup security update

Published
May 6, 2025
Last Modified
November 5, 2026

🔗 CVE IDs covered (5)

CVE-2025-32906 →CVE-2025-32911 →CVE-2025-32913 →CVE-2025-46420 →CVE-2025-46421 →

📋 Description

CVE-2025-32906 — libsoup: Out of bounds reads in soup_headers_parse_request() CVE-2025-32911 — libsoup: Double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" GHashTable value CVE-2025-32913 — libsoup: NULL pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in Content-Disposition header CVE-2025-46420 — libsoup: Memory leak on soup_header_parse_quality_list() via soup-headers.c CVE-2025-46421 — libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server

🎯 Affected products15

  • Red Hat Enterprise Linux AppStream AUS (v. 8.2)
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2)
  • libsoup-0:2.62.3-1.el8_2.4.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)
  • libsoup-0:2.62.3-1.el8_2.4.src as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)
  • libsoup-0:2.62.3-1.el8_2.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)
  • libsoup-debuginfo-0:2.62.3-1.el8_2.4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)
  • libsoup-debuginfo-0:2.62.3-1.el8_2.4.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)
  • libsoup-debuginfo-0:2.62.3-1.el8_2.4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)
  • libsoup-debuginfo-0:2.62.3-1.el8_2.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)
  • libsoup-debugsource-0:2.62.3-1.el8_2.4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)
  • libsoup-debugsource-0:2.62.3-1.el8_2.4.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)
  • libsoup-debugsource-0:2.62.3-1.el8_2.4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)
  • libsoup-debugsource-0:2.62.3-1.el8_2.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)
  • libsoup-devel-0:2.62.3-1.el8_2.4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)
  • libsoup-devel-0:2.62.3-1.el8_2.4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Currently, no mitigation was found for this vulnerability. Workaround: Currently, no mitigation is available for this vulnerability.

🔗 References (8)