RHSA-2025:4609HighCVSS 9.0

Red Hat Security Advisory: libsoup security update

Published
May 7, 2025
Last Modified
November 5, 2026

🔗 CVE IDs covered (5)

CVE-2025-32906 →CVE-2025-32911 →CVE-2025-32913 →CVE-2025-46420 →CVE-2025-46421 →

📋 Description

CVE-2025-32906 — libsoup: Out of bounds reads in soup_headers_parse_request() CVE-2025-32911 — libsoup: Double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" GHashTable value CVE-2025-32913 — libsoup: NULL pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in Content-Disposition header CVE-2025-46420 — libsoup: Memory leak on soup_header_parse_quality_list() via soup-headers.c CVE-2025-46421 — libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server

🎯 Affected products51

  • Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • Red Hat Enterprise Linux AppStream E4S (v.8.4)
  • Red Hat Enterprise Linux AppStream TUS (v.8.4)
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • Red Hat Enterprise Linux BaseOS TUS (v.8.4)
  • libsoup-0:2.62.3-2.el8_4.4.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • libsoup-0:2.62.3-2.el8_4.4.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • libsoup-0:2.62.3-2.el8_4.4.i686 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.4)
  • libsoup-0:2.62.3-2.el8_4.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • libsoup-0:2.62.3-2.el8_4.4.src as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • libsoup-0:2.62.3-2.el8_4.4.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • libsoup-0:2.62.3-2.el8_4.4.src as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.4)
  • libsoup-0:2.62.3-2.el8_4.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • libsoup-0:2.62.3-2.el8_4.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • libsoup-0:2.62.3-2.el8_4.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.4)
  • libsoup-debuginfo-0:2.62.3-2.el8_4.4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • libsoup-debuginfo-0:2.62.3-2.el8_4.4.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.4)
  • libsoup-debuginfo-0:2.62.3-2.el8_4.4.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.4)
  • libsoup-debuginfo-0:2.62.3-2.el8_4.4.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • libsoup-debuginfo-0:2.62.3-2.el8_4.4.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • libsoup-debuginfo-0:2.62.3-2.el8_4.4.i686 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.4)
  • libsoup-debuginfo-0:2.62.3-2.el8_4.4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.4)
  • libsoup-debuginfo-0:2.62.3-2.el8_4.4.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • libsoup-debuginfo-0:2.62.3-2.el8_4.4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • libsoup-debuginfo-0:2.62.3-2.el8_4.4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.4)
  • libsoup-debuginfo-0:2.62.3-2.el8_4.4.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.4)
  • libsoup-debuginfo-0:2.62.3-2.el8_4.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • libsoup-debuginfo-0:2.62.3-2.el8_4.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • libsoup-debuginfo-0:2.62.3-2.el8_4.4.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.4)
  • +21 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Currently, no mitigation was found for this vulnerability. Workaround: Currently, no mitigation is available for this vulnerability.

🔗 References (8)