Most recent entries from all

ALSA-2025:7505 — Important: libsoup3 security update

Affected: AlmaLinux:10: libsoup3, AlmaLinux:10: libsoup3-devel, AlmaLinux:10: libsoup3-doc

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784) * libsoup: Out of bounds reads in soup_headers_parse_request() (CVE-2025-32906) * libsoup: Denial of service on libsoup through HTTP/2 server (CVE-2025-32908) * libsoup: NULL pointer dereference in client when server omits the "nonce" parameter in an Unauthorized response with Digest authentication (CVE-2025-32912) * libsoup: OOB Read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process (CVE-2025-32914) * libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server (CVE-2025-46421)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in th…

bdu:2025-07140

EUVD-2026-331255

fkie_cve-2025-32912

A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash.

GHSA-hhmv-6rqc-qrc8

A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash.

msrc_CVE-2025-32912 — Libsoup: null pointer dereference in client when server omits the "nonce" parameter in an unauthorized response with d…

msrc_CVE-2025-32912

OESA-2025-1460 — libsoup security update

Affected: openEuler:20.03-LTS-SP4: libsoup, openEuler:22.03-LTS-SP3: libsoup, openEuler:22.03-LTS-SP4: libsoup, openEuler:24.03-LTS: libsoup, openEuler:24.03-LTS-SP1: libsoup

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fix(es):

A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server.(CVE-2025-32906)

A flaw was found in libsoup. SoupContentSniffer may be vulnerable to a NULL pointer dereference in the sniff_mp4 function. The HTTP server may cause the libsoup client to crash.(CVE-2025-32909)

A flaw was found in libsoup, where soup_auth_digest_authenticate() is vulnerable to a NULL pointer dereference. This issue may cause the libsoup client to crash.(CVE-2025-32910)

A flaw was found in libsoup, which is vulnerable to a use-after-free memory issue not on the heap in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.(CVE-2025-32911)

A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash.(CVE-2025-32912)

A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client or server that uses th…

openSUSE-SU-2025:15189-1 — libsoup-2_4-1-2.74.3-11.1 on GA media

libsoup-2_4-1-2.74.3-11.1 on GA media

RHSA-2025:7505 — Red Hat Security Advisory: libsoup3 security update

libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content libsoup: Out of bounds reads in soup_headers_parse_request() libsoup: Denial of service on libsoup through HTTP/2 server libsoup: NULL pointer dereference in client when server omits the "nonce" parameter in an Unauthorized response with Digest authentication libsoup: OOB Read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server

SUSE-SU-2025:01794-1 — Security update for libsoup

Security update for libsoup

UBUNTU-CVE-2025-32912

Affected: Ubuntu:Pro:16.04:LTS: libsoup2.4, Ubuntu:Pro:18.04:LTS: libsoup2.4, Ubuntu:20.04:LTS: libsoup2.4, Ubuntu:22.04:LTS: libsoup2.4, Ubuntu:Pro:22.04:LTS: libsoup3, Ubuntu:24.04:LTS: libsoup2.4, Ubuntu:24.04:LTS: libsoup3

A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash.