A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS).

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-7505 advisory.

    - Fix CVE-2025-4035, CVE-2025-4948, CVE-2025-32049, CVE-2025-32907

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7505 advisory.

    Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access     Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate     packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This     enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion,     very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who     want it), but the SOAP parts were removed long ago.

    Security Fix(es):

    * libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784)

    * libsoup: Out of bounds reads in soup_headers_parse_request() (CVE-2025-32906)

    * libsoup: Denial of service on libsoup through HTTP/2 server (CVE-2025-32908)

    * libsoup: NULL pointer dereference in client when server  omits the nonce parameter in an Unauthorized     response with Digest  authentication (CVE-2025-32912)

    * libsoup: OOB Read on libsoup through function  soup_multipart_new_from_message in soup-multipart.c     leads to crash or  exit of process (CVE-2025-32914)

    * libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host     when being redirected by a server (CVE-2025-46421)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01504-1 advisory.

    - CVE-2025-2784: Fixed heap buffer over-read in `skip_insignificant_space` when sniffing conten     (bsc#1240750)
     - CVE-2025-32050: Fixed integer overflow in append_param_quoted (bsc#1240752)
     - CVE-2025-32051: Fixed segmentation fault when parsing malformed data URI (bsc#1240754)
     - CVE-2025-32052: Fixed heap buffer overflow in sniff_unknown() (bsc#1240756)
     - CVE-2025-32053: Fixed heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space()     (bsc#1240757)
     - CVE-2025-32906: Fixed out of bounds reads in soup_headers_parse_request() (bsc#1241263)
     - CVE-2025-32907: Fixed excessive memory consumption in server when client requests a large amount of     overlapping ranges in a single HTTP request (bsc#1241222)
     - CVE-2025-32908: Fixed HTTP request may lead to server crash due to HTTP/2 server not fully validating     the values of pseudo-headers (bsc#1241223)
     - CVE-2025-32909: Fixed NULL pointer dereference in the sniff_mp4 function in soup-content-sniffer.c     (bsc#1241226)
     - CVE-2025-32910: Fixed NULL pointer deference on client when server omits the realm parameter in an     Unauthorized response with Digest authentication (bsc#1241252)
     - CVE-2025-32911: Fixed double free on soup_message_headers_get_content_disposition() via 'params'     (bsc#1241238)
     - CVE-2025-32912: Fixed NULL pointer dereference in SoupAuthDigest (bsc#1241214)
     - CVE-2025-32913: Fixed NULL pointer dereference in soup_message_headers_get_content_disposition     (bsc#1241162)
     - CVE-2025-32914: Fixed out of bounds read in `soup_multipart_new_from_message()` (bsc#1241164)
     - CVE-2025-46420: Fixed memory leak on soup_header_parse_quality_list() via soup-headers.c (bsc#1241686)
     - CVE-2025-46421: Fixed HTTP Authorization Header leak via an HTTP redirect (bsc#1241688)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7543-1 advisory.

    Jan Raski discovered that libsoup incorrectly handled certain headers when sending HTTP/2 requests     over TLS. An attacker could possibly use this issue to cause a denial of service. This issue only affected     libsoup3 in Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2025-32908)

    Jan Raski discovered that libsoup incorrectly parsed certain response headers. An attacker could     possibly use this issue to cause a denial of service. (CVE-2025-4476)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the libsoup package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-961 advisory.

    A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource     consumption attack. This flaw allows a malicious client to request the same range many times in a single     HTTP request, causing the server to use large amounts of memory. (CVE-2025-32907)

    A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-     headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS).
    (CVE-2025-32908)

    A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-     of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of     bounds. (CVE-2025-32914)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1504-1 advisory.

    - CVE-2025-2784: Fixed heap buffer over-read in `skip_insignificant_space` when sniffing conten     (bsc#1240750)
     - CVE-2025-32050: Fixed integer overflow in append_param_quoted (bsc#1240752)
     - CVE-2025-32051: Fixed segmentation fault when parsing malformed data URI (bsc#1240754)
     - CVE-2025-32052: Fixed heap buffer overflow in sniff_unknown() (bsc#1240756)
     - CVE-2025-32053: Fixed heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space()     (bsc#1240757)
     - CVE-2025-32906: Fixed out of bounds reads in soup_headers_parse_request() (bsc#1241263)
     - CVE-2025-32907: Fixed excessive memory consumption in server when client requests a large amount of     overlapping ranges in a single HTTP request (bsc#1241222)
     - CVE-2025-32908: Fixed HTTP request may lead to server crash due to HTTP/2 server not fully validating     the values of pseudo-headers (bsc#1241223)
     - CVE-2025-32909: Fixed NULL pointer dereference in the sniff_mp4 function in soup-content-sniffer.c     (bsc#1241226)
     - CVE-2025-32910: Fixed NULL pointer deference on client when server omits the realm parameter in an     Unauthorized response with Digest authentication (bsc#1241252)
     - CVE-2025-32911: Fixed double free on soup_message_headers_get_content_disposition() via 'params'     (bsc#1241238)
     - CVE-2025-32912: Fixed NULL pointer dereference in SoupAuthDigest (bsc#1241214)
     - CVE-2025-32913: Fixed NULL pointer dereference in soup_message_headers_get_content_disposition     (bsc#1241162)
     - CVE-2025-32914: Fixed out of bounds read in `soup_multipart_new_from_message()` (bsc#1241164)
     - CVE-2025-46420: Fixed memory leak on soup_header_parse_quality_list() via soup-headers.c (bsc#1241686)
     - CVE-2025-46421: Fixed HTTP Authorization Header leak via an HTTP redirect (bsc#1241688)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241047	Oracle Linux 10 : libsoup3 (ELSA-2025-7505)	Nessus	Oracle Linux Local Security Checks	medium
237856	RHEL 10 : libsoup3 (RHSA-2025:7505)	Nessus	Red Hat Local Security Checks	high
237542	SUSE SLED15 / SLES15 Security Update : libsoup (SUSE-SU-2025:01504-1)	Nessus	SuSE Local Security Checks	medium
237450	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : libsoup vulnerabilities (USN-7543-1)	Nessus	Ubuntu Local Security Checks	medium
236799	Photon OS 5.0: Libsoup PHSA-2025-5.0-0522	Nessus	PhotonOS Local Security Checks	medium
235912	Amazon Linux 2023 : libsoup3, libsoup3-devel (ALAS2023-2025-961)	Nessus	Amazon Linux Local Security Checks	high
235644	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libsoup (SUSE-SU-2025:1504-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2025-32908

high

Tenable Plugins

medium

high

medium

medium

medium

high

high