RHSA-2025:8128HighCVSS 7.5

Red Hat Security Advisory: libsoup3 security update

Published
May 26, 2025
Last Modified
November 5, 2026

🔗 CVE IDs covered (4)

CVE-2025-32049 →CVE-2025-32907 →CVE-2025-4035 →CVE-2025-4948 →

📋 Description

CVE-2025-4035 — libsoup: Cookie domain validation bypass via uppercase characters in libsoup CVE-2025-4948 — libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup CVE-2025-32049 — libsoup: Denial of Service attack to websocket server CVE-2025-32907 — libsoup: Denial of service in server when client requests a large amount of overlapping ranges with Range header

🎯 Affected products20

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • libsoup3-0:3.6.5-3.el10_0.6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-0:3.6.5-3.el10_0.6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-0:3.6.5-3.el10_0.6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-0:3.6.5-3.el10_0.6.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-0:3.6.5-3.el10_0.6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-debuginfo-0:3.6.5-3.el10_0.6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-debuginfo-0:3.6.5-3.el10_0.6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-debuginfo-0:3.6.5-3.el10_0.6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-debuginfo-0:3.6.5-3.el10_0.6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-debugsource-0:3.6.5-3.el10_0.6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-debugsource-0:3.6.5-3.el10_0.6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-debugsource-0:3.6.5-3.el10_0.6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-debugsource-0:3.6.5-3.el10_0.6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-devel-0:3.6.5-3.el10_0.6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-devel-0:3.6.5-3.el10_0.6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-devel-0:3.6.5-3.el10_0.6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-devel-0:3.6.5-3.el10_0.6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsoup3-doc-0:3.6.5-3.el10_0.6.noarch as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, Red Hat recommends avoiding the use of libsoup with untrusted or unauthenticated multipart HTTP message sources until updated packages are available. Administrators can deploy application-level filters or HTTP proxies that reject malformed multipart requests. It is strongly advised to apply vendor-supplied patches as soon as they are released to address this integer underflow vulnerability and restore the stability of affected services. Workaround: No mitigation is currently available for this vulnerability. Workaround: Currently, no mitigation was found for this vulnerability.

🔗 References (7)