{"id":"CVE-2025-4476","aliases":["AZL-61902","AZL-61910","DEBIAN-CVE-2025-4476","DLA-4398-1","EUVD-2025-15540","GHSA-qgq4-89p9-qfrh","MGASA-2025-0261","OESA-2025-1632","OESA-2025-2209","OESA-2025-2210","OESA-2025-2279","SUSE-SU-2025:01812-1","SUSE-SU-2025:01817-1","SUSE-SU-2025:20453-1","SUSE-SU-2025:20598-1","SUSE-SU-2026:0469-1","SUSE-SU-2026:0497-1","SUSE-SU-2026:0574-1","SUSE-SU-2026:0703-1","UBUNTU-CVE-2025-4476","USN-7543-1","openSUSE-SU-2025:15185-1","openSUSE-SU-2026:10166-1","openSUSE-SU-2026:20354-1"],"status":"published","title":"Libsoup: null pointer dereference in libsoup may lead to denial of service","description":"A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client application into connecting to the attacker's malicious server.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0055,"percentile":0.4647,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-476"],"published":"2025-05-16T17:56:58Z","modified":"2026-11-05T05:40:51Z","exploits":[{"source":"pocgithub","id":"soltanali0/CVE-2025-4476-Exploit","title":"soltanali0/CVE-2025-4476-Exploit","date":"2025-10-09","url":"https://github.com/soltanali0/CVE-2025-4476-Exploit"}],"fixes":[{"ecosystem":"Azure Linux:2","package":"libsoup","fixed_in":["3.0.4-7"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libsoup","fixed_in":["3.4.4-7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libsoup3","fixed_in":["3.6.5-2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libsoup3","fixed_in":["3.4.4-5.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"libsoup3","fixed_in":["3.4.4-5.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"libsoup3","fixed_in":["3.4.4-5.oe2403"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libsoup","fixed_in":["2.68.4-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libsoup2.4","fixed_in":["2.52.2-1ubuntu0.3+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsoup2.4","fixed_in":["2.62.1-1ubuntu0.4+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libsoup2.4","fixed_in":["2.70.0-1ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libsoup2.4","fixed_in":["2.74.2-3ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libsoup3","fixed_in":["3.0.7-0ubuntu1+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libsoup2.4","fixed_in":["2.74.3-6ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libsoup3","fixed_in":["3.4.4-5ubuntu0.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-1","2.74.3-1+deb12u1","2.74.3-10","2.74.3-10.1","2.74.3-11","2.74.3-2","2.74.3-3","2.74.3-3.1~exp1","2.74.3-3.1~exp2","2.74.3-3.1~exp3","2.74.3-5","2.74.3-6","2.74.3-7","2.74.3-8","2.74.3-8.1","2.74.3-9"]},{"source":"osv","ecosystem":"Debian:13","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74.3-10.1","2.74.3-11"]},{"source":"osv","ecosystem":"Debian:12","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.2-2","3.2.3-0+deb12u1","3.2.3-0+deb12u2","3.3.1-1","3.4.0-1","3.4.1-1","3.4.2-1","3.4.2-2","3.4.2-3","3.4.2-4","3.4.3-1","3.4.4-1","3.4.4-2","3.4.4-3","3.4.4-4","3.4.4-5","3.5.2-1","3.6.0-1","3.6.0-2","3.6.0-3","3.6.0-4","3.6.1-1","3.6.4-1","3.6.4-2","3.6.4-3","3.6.5-1","3.6.5-2","3.6.5-3","3.6.5-4","3.6.5-5","3.6.5-6","3.6.5-7","3.6.5-8","3.6.5-9","3.6.6-1","3.8.0-1","3.8.0-2","3.8.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.0-2+deb11u3"}]}],"versions":["2.72.0-2","2.72.0-2+deb11u1","2.72.0-2+deb11u2"],"bundled":4},{"source":"osv","ecosystem":"Mageia:9","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1.2.mga9"}]}],"bundled":18},{"source":"osv","ecosystem":"Mageia:9","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-1.2.mga9"}]}],"bundled":18},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-10.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-10.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.71.0-9.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-10.oe2203sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-10.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-5.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-5.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-5.oe2403"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-150600.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-150400.3.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-slfo.1.1_4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.68.4-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-150400.3.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-150600.4.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.34.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.34.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.2-1ubuntu0.3+esm3"}]}],"versions":["2.50.0-2debian1","2.52.1-1","2.52.2-1","2.52.2-1ubuntu0.1","2.52.2-1ubuntu0.2","2.52.2-1ubuntu0.3","2.52.2-1ubuntu0.3+esm1","2.52.2-1ubuntu0.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.1-1ubuntu0.4+esm4"}]}],"versions":["2.60.1-1","2.60.2-1","2.60.2-2","2.60.3-1","2.61.90-1","2.62.0-1","2.62.1-1","2.62.1-1ubuntu0.1","2.62.1-1ubuntu0.3","2.62.1-1ubuntu0.4","2.62.1-1ubuntu0.4+esm1","2.62.1-1ubuntu0.4+esm2","2.62.1-1ubuntu0.4+esm3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.70.0-1ubuntu0.5"}]}],"versions":["2.68.2-0ubuntu1","2.68.2-1","2.68.2-2","2.68.2-2build2","2.69.90-1","2.70.0-1","2.70.0-1ubuntu0.1","2.70.0-1ubuntu0.2","2.70.0-1ubuntu0.3","2.70.0-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-3ubuntu0.5"}]}],"versions":["2.72.0-3ubuntu3","2.74.1-1","2.74.2-2","2.74.2-3","2.74.2-3ubuntu0.1","2.74.2-3ubuntu0.2","2.74.2-3ubuntu0.3","2.74.2-3ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-0ubuntu1+esm4"}]}],"versions":["3.0.4-2","3.0.4-3","3.0.5-1","3.0.7-0ubuntu1","3.0.7-0ubuntu1+esm1","3.0.7-0ubuntu1+esm2","3.0.7-0ubuntu1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-6ubuntu1.5"}]}],"versions":["2.74.3-1","2.74.3-2","2.74.3-3","2.74.3-6","2.74.3-6build1","2.74.3-6ubuntu1","2.74.3-6ubuntu1.1","2.74.3-6ubuntu1.2","2.74.3-6ubuntu1.3","2.74.3-6ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-5ubuntu0.4"}]}],"versions":["3.4.2-4","3.4.4-1","3.4.4-2","3.4.4-4","3.4.4-5","3.4.4-5build1","3.4.4-5build2","3.4.4-5ubuntu0.1","3.4.4-5ubuntu0.2","3.4.4-5ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.2-1ubuntu0.3+esm3"}]}],"versions":["2.50.0-2debian1","2.52.1-1","2.52.2-1","2.52.2-1ubuntu0.1","2.52.2-1ubuntu0.2","2.52.2-1ubuntu0.3","2.52.2-1ubuntu0.3+esm1","2.52.2-1ubuntu0.3+esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.1-1ubuntu0.4+esm4"}]}],"versions":["2.60.1-1","2.60.2-1","2.60.2-2","2.60.3-1","2.61.90-1","2.62.0-1","2.62.1-1","2.62.1-1ubuntu0.1","2.62.1-1ubuntu0.3","2.62.1-1ubuntu0.4","2.62.1-1ubuntu0.4+esm1","2.62.1-1ubuntu0.4+esm2","2.62.1-1ubuntu0.4+esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.70.0-1ubuntu0.5"}]}],"versions":["2.68.2-0ubuntu1","2.68.2-1","2.68.2-2","2.68.2-2build2","2.69.90-1","2.70.0-1","2.70.0-1ubuntu0.1","2.70.0-1ubuntu0.2","2.70.0-1ubuntu0.3","2.70.0-1ubuntu0.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-3ubuntu0.5"}]}],"versions":["2.72.0-3ubuntu3","2.74.1-1","2.74.2-2","2.74.2-3","2.74.2-3ubuntu0.1","2.74.2-3ubuntu0.2","2.74.2-3ubuntu0.3","2.74.2-3ubuntu0.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-0ubuntu1+esm4"}]}],"versions":["3.0.4-2","3.0.4-3","3.0.5-1","3.0.7-0ubuntu1","3.0.7-0ubuntu1+esm1","3.0.7-0ubuntu1+esm2","3.0.7-0ubuntu1+esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-6ubuntu1.5"}]}],"versions":["2.74.3-1","2.74.3-2","2.74.3-3","2.74.3-6","2.74.3-6build1","2.74.3-6ubuntu1","2.74.3-6ubuntu1.1","2.74.3-6ubuntu1.2","2.74.3-6ubuntu1.3","2.74.3-6ubuntu1.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsoup3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-5ubuntu0.4"}]}],"versions":["3.4.2-4","3.4.4-1","3.4.4-2","3.4.4-4","3.4.4-5","3.4.4-5build1","3.4.4-5build2","3.4.4-5ubuntu0.1","3.4.4-5ubuntu0.2","3.4.4-5ubuntu0.3"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libsoup2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-160000.4.1"}]}],"bundled":11}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-4476","tags":["vdb-entry","x_refsource_REDHAT","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2366513","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/issues/440","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/work_items/440","tags":["exploit","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4476","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qgq4-89p9-qfrh"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4476.json","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-4476","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0261.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34187","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7432-1","tags":["advisory"]},{"url":"https://openwall.com/lists/oss-security/2025/04/18/4","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/53THXHSDPP4TLMFRSP5DPLY4DK72M7XY/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-7543-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/NK7USYFSJPRTIVISSEDBLS53JCM5ETOI/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/EPLHUVQI4JICGWTVGG7KI7D4BMHB34YD/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1632","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4948","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4969","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2209","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2210","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2279","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501812-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243332","tags":["report"]},{"url":"https://bugzilla.suse.com/1243422","tags":["report"]},{"url":"https://bugzilla.suse.com/1243423","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4969","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501817-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520453-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243314","tags":["report"]},{"url":"https://bugzilla.suse.com/528882","tags":["report"]},{"url":"https://bugzilla.suse.com/553466","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4945","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520598-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260469-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260497-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256418","tags":["report"]},{"url":"https://bugzilla.suse.com/1257598","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1761","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260574-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260703-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1240751","tags":["report"]},{"url":"https://bugzilla.suse.com/1258120","tags":["report"]},{"url":"https://bugzilla.suse.com/1258170","tags":["report"]},{"url":"https://bugzilla.suse.com/1258508","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2708","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-4476","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-4476","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/457","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-32908","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1254876","tags":["report"]},{"url":"https://bugzilla.suse.com/1256399","tags":["report"]},{"url":"https://bugzilla.suse.com/1257398","tags":["report"]},{"url":"https://bugzilla.suse.com/1257441","tags":["report"]},{"url":"https://bugzilla.suse.com/1257597","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1760","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-4476","title":"Libsoup: null pointer dereference in libsoup may lead to denial of service","description":"A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client application into connecting to the attacker's malicious server.","status":"published","published":"2025-05-16T17:56:58.302Z","modified":"2026-11-06T17:43:48.97Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-476"],"updated_at":"2026-11-06T18:59:07.714367Z"}],"euvd":[{"id":"EUVD-2025-15540","description":"A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client application into connecting to the attacker's malicious server.","status":"published","published":"2025-05-16T17:56:58Z","modified":"2026-11-06T17:43:48Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-06T19:05:53.354277Z"}],"ghsa":[{"id":"GHSA-qgq4-89p9-qfrh","title":"A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This...","description":"A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client application into connecting to the attacker's malicious server.","status":"published","published":"2025-05-16T18:31:10Z","modified":"2026-05-06T18:30:23Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:07:55.247215Z"}],"nvd":[{"id":"CVE-2025-4476","description":"A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client application into connecting to the attacker's malicious server.","status":"published","published":"2025-05-16T18:16:10.97Z","modified":"2026-11-06T18:17:20.41Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-06T20:01:10.091781Z"}],"osv":[{"id":"AZL-61902","title":"CVE-2025-4476 affecting package libsoup for versions less than 3.0.4-7","description":"A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client application into connecting to the attacker's malicious server.","status":"published","published":"2025-05-16T18:16:10Z","modified":"2026-04-21T04:31:52.703524Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"AZL-61910","title":"CVE-2025-4476 affecting package libsoup for versions less than 3.4.4-7","description":"A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client application into connecting to the attacker's malicious server.","status":"published","published":"2025-05-16T18:16:10Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"CVE-2025-4476","title":"Libsoup: null pointer dereference in libsoup may lead to denial of service","description":"A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client application into connecting to the attacker's malicious server.","status":"published","published":"2025-05-16T17:56:58.302Z","modified":"2026-11-08T02:31:03.149974033Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-07T03:07:57.024029Z"},{"id":"DEBIAN-CVE-2025-4476","description":"A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client application into connecting to the attacker's malicious server.","status":"published","published":"2025-05-16T18:16:10.97Z","modified":"2026-11-07T09:47:31.758436745Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"OESA-2025-1632","title":"libsoup security update","description":"libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications.\r\n\r\nSecurity Fix(es):\n\nA denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user\u0026apos;s application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user\u0026apos;s client application into connecting to the attacker\u0026apos;s malicious server.(CVE-2025-4476)\n\nA flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart messages. Due to improper validation, an internal calculation can go wrong, leading to an integer underflow. This can cause the program to access invalid memory and crash. As a result, any application or server using libsoup could be forced to exit unexpectedly, creating a denial-of-service (DoS) risk.(CVE-2025-4948)\n\nA vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted multipart HTTP body, causing the libsoup-consuming server to read beyond its allocated memory boundaries (out-of-bounds read).(CVE-2025-4969)","status":"published","published":"2025-06-13T11:08:43Z","modified":"2026-08-18T01:18:51.762016122Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-2209","title":"libsoup3 security update","description":"Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.\r\n\r\nSecurity Fix(es):\n\nA denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user\u0026apos;s application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user\u0026apos;s client application into connecting to the attacker\u0026apos;s malicious server.(CVE-2025-4476)","status":"published","published":"2025-09-05T11:09:17Z","modified":"2026-08-18T01:18:11.155710184Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2210","title":"libsoup3 security update","description":"Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.\r\n\r\nSecurity Fix(es):\n\nA denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user\u0026apos;s application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user\u0026apos;s client application into connecting to the attacker\u0026apos;s malicious server.(CVE-2025-4476)","status":"published","published":"2025-09-05T11:09:17Z","modified":"2026-08-18T01:18:11.192318874Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2279","title":"libsoup3 security update","description":"Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.\r\n\r\nSecurity Fix(es):\n\nA denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user\u0026apos;s application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user\u0026apos;s client application into connecting to the attacker\u0026apos;s malicious server.(CVE-2025-4476)","status":"published","published":"2025-09-12T11:09:21Z","modified":"2026-08-18T01:19:10.2120673Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"UBUNTU-CVE-2025-4476","description":"A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client application into connecting to the attacker's malicious server.","status":"published","published":"2025-05-16T18:16:00Z","modified":"2026-04-22T16:03:22.301431Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"DLA-4398-1","title":"libsoup2.4 - security update","status":"published","published":"2025-12-09T00:00:00Z","modified":"2025-12-09T18:18:10.517994Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2025-0261","title":"Updated libsoup3 \u0026 libsoup packages fix security vulnerabilities","description":"Libsoup: heap buffer over-read in `skip_insignificant_space` when\nsniffing content. (CVE-2025-2784)\nLibsoup: denial of service attack to websocket server. (CVE-2025-32049)\nLibsoup: integer overflow in append_param_quoted. (CVE-2025-32050)\nLibsoup: segmentation fault when parsing malformed data uri.\n(CVE-2025-32051)\nLibsoup: heap buffer overflow in sniff_unknown(). (CVE-2025-32052)\nLibsoup: heap buffer overflows in sniff_feed_or_html() and\nskip_insignificant_space(). (CVE-2025-32053)\nLibsoup: out of bounds reads in soup_headers_parse_request().\n(CVE-2025-32906)\nLibsoup: denial of service in server when client requests a large amount\nof overlapping ranges with range header. (CVE-2025-32907)\nLibsoup: denial of service on libsoup through http/2 server.\n(CVE-2025-32908)\nLibsoup: null pointer dereference on libsoup through function\n\"sniff_mp4\" in soup-content-sniffer.c. (CVE-2025-32909)\nLibsoup: null pointer deference on libsoup via /auth/soup-auth-digest.c\nthrough \"soup_auth_digest_authenticate\" on client when server omits the\n\"realm\" parameter in an unauthorized response with digest\nauthentication. (CVE-2025-32910)\nLibsoup: double free on soup_message_headers_get_content_disposition()\nthrough \"soup-message-headers.c\" via \"params\" ghashtable value.\n(CVE-2025-32911)\nLibsoup: null pointer dereference in client when server omits the\n\"nonce\" parameter in an unauthorized response with digest\nauthentication. (CVE-2025-32912)\nLibsoup: null pointer dereference in\nsoup_message_headers_get_content_disposition when \"filename\" parameter\nis present, but has no value in content-disposition header.\n(CVE-2025-32913)\nLibsoup: oob read on libsoup through function\n\"soup_multipart_new_from_message\" in soup-multipart.c leads to crash or\nexit of process. (CVE-2025-32914)\nLibsoup: memory leak on soup_header_parse_quality_list() via\nsoup-headers.c. (CVE-2025-46420)\nLibsoup: information disclosure may leads libsoup client sends\nauthorization header to a different host when being redirected by a\nserver. (CVE-2025-46421)\nLibsoup: null pointer dereference in libsoup may lead to denial of\nservice. (CVE-2025-4476)\nLibsoup: integer overflow in cookie expiration date handling in libsoup.\n(CVE-2025-4945)\n","status":"published","published":"2025-11-05T22:49:51Z","modified":"2026-04-16T04:41:13.813289008Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15185-1","title":"libsoup-3_0-0-3.6.5-5.1 on GA media","description":"These are all security issues fixed in the libsoup-3_0-0-3.6.5-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-31T00:00:00Z","modified":"2026-03-23T04:53:27.410841Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:10166-1","title":"libsoup-2_4-1-2.74.3-15.1 on GA media","description":"These are all security issues fixed in the libsoup-2_4-1-2.74.3-15.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-10T00:00:00Z","modified":"2026-03-23T04:54:31.577635Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20354-1","title":"Security update for libsoup2","description":"This update for libsoup2 fixes the following issues:\n\n- CVE-2025-4476: null pointer dereference may lead to denial of service (bsc#1243422).\n- CVE-2025-14523: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (bsc#1254876).\n- CVE-2025-32049: Denial of Service attack to websocket server (bsc#1240751).\n- CVE-2026-0716: improper bounds handling may allow out-of-bounds read (bsc#1256418).\n- CVE-2026-0719: stack-based buffer overflow in NTLM authentication can lead to arbitrary code execution (bsc#1256399).\n- CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).\n- CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects\n  (bsc#1257441).\n- CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request\n  smuggling and potential DoS (bsc#1257597).\n- CVE-2026-2369: Buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).\n- CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information\n  disclosure to remote attackers (bsc#1258170).\n- CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).\n","status":"published","published":"2026-03-13T08:41:04Z","modified":"2026-03-23T04:54:51.216884Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2025:01812-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2025-4969: Fixed off-by-one out-of-bounds read may lead to infoleak (bsc#1243423) \n- CVE-2025-4948: Fixed integer underflow in soup_multipart_new_from_message() leading to denial of service (bsc#1243332) \n- CVE-2025-4476: Fixed NULL pointer dereference may lead to denial of service (bsc#1243422) \n","status":"published","published":"2025-06-04T10:12:11Z","modified":"2026-03-23T04:47:38.684508Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01817-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2025-4969: Fixed off-by-one out-of-bounds read may lead to infoleak (bsc#1243423) \n- CVE-2025-4948: Fixed integer underflow in soup_multipart_new_from_message() leading to denial of service (bsc#1243332) \n- CVE-2025-4476: Fixed NULL pointer dereference may lead to denial of service (bsc#1243422) \n","status":"published","published":"2025-06-05T06:52:42Z","modified":"2026-02-04T03:19:36.974458Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:20453-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2025-4476: Fixed null pointer dereference that may lead to denial of service (bsc#1243422)\n- CVE-2025-4948: Fixed Integer Underflow in\n  soup_multipart_new_from_message() Leading to Denial of Service in libsoup\n  (bsc#1243332)\n- CVE-2025-4969: Fixed off-by-one out-of-bounds read may lead to infoleak (bsc#1243423)\n- CVE-2025-4945: Fixed Integer Overflow in Cookie Expiration Date Handling in libsoup (bsc#1243314)\n","status":"published","published":"2025-06-28T05:47:32Z","modified":"2026-03-23T04:48:16.565232Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20598-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2025-4945: Fixed Integer Overflow in Cookie Expiration Date Handling (bsc#1243314)\n- CVE-2025-4948: Fixed Integer Underflow in soup_multipart_new_from_message()\n  Leading to Denial of Service (bsc#1243332)\n- CVE-2025-4476: Fixed null pointer dereference leading to denial of service (bsc#1243422)\n- CVE-2025-4969: Fixed off-by-one out-of-bounds read leading to infoleak (bsc#1243423)\n","status":"published","published":"2025-08-21T09:33:10Z","modified":"2026-03-23T04:48:20.399719Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2026:0469-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2025-4476: null pointer dereference may lead to denial of service (bsc#1243422).\n","status":"published","published":"2026-02-12T11:21:36Z","modified":"2026-03-23T04:52:15.853734Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0497-1","title":"Security update for libsoup2","description":"This update for libsoup2 fixes the following issues:\n\n- CVE-2026-1761: Check length of bytes read in soup_filter_input_stream_read_until to avoid a stack-based buffer\n  overflow (bsc#1257598).\n- CVE-2026-0716: improper bounds handling may allow out-of-bounds read (bsc#1256418).\n- CVE-2025-4476: null pointer dereference may lead to denial of service (bsc#1243422).\n","status":"published","published":"2026-02-13T10:56:05Z","modified":"2026-03-23T04:52:17.815133Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0574-1","title":"Security update for libsoup2","description":"This update for libsoup2 fixes the following issues:\n\n- CVE-2026-1761: incorrect length calculation when parsing of multipart HTTP responses can lead to a stack-based buffer overflow\n  (bsc#1257598).\n- CVE-2026-0716: improper bounds handling may allow out-of-bounds read (bsc#1256418).\n- CVE-2025-4476: null pointer dereference may lead to denial of service (bsc#1243422).\n","status":"published","published":"2026-02-18T08:03:04Z","modified":"2026-03-23T04:52:21.486082Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0703-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- CVE-2026-0716: improper bounds handling may allow out-of-bounds read (bsc#1256418).\n- CVE-2025-4476: null pointer dereference may lead to denial of service (bsc#1243422).\n- CVE-2025-32049: denial of Service attack to websocket server (bsc#1240751).\n- CVE-2026-2369: buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).\n- CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information\n  disclosure to remote attackers (bsc#1258170).\n- CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).\n","status":"published","published":"2026-02-28T10:01:49Z","modified":"2026-03-23T04:51:38.258573Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"USN-7543-1","title":"libsoup3, libsoup2.4 vulnerabilities","description":"Jan Różański discovered that libsoup incorrectly handled certain headers\nwhen sending HTTP/2 requests over TLS. An attacker could possibly use this\nissue to cause a denial of service. This issue only affected libsoup3 in\nUbuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2025-32908)\n\nJan Różański discovered that libsoup incorrectly parsed certain response\nheaders. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2025-4476)","status":"published","published":"2025-05-28T14:27:53Z","modified":"2026-06-25T13:32:30.496718281Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}