A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS).

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0587 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-32907:
    A use-after-free type vulnerability was found in libsoup, in the     soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause     memory corruption in the libsoup server.

    CVE-2025-32052:
    A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource     consumption attack. This flaw allows a malicious client to request the same range many times in a single     HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of     service.

    CVE-2025-2784:
    A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-     of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of     bounds.

    CVE-2025-32053:
    A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is     vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client     or server that uses this function.

    CVE-2025-32906:
    A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-     headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS).

    CVE-2025-32913:
    A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-     of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP     server.

    CVE-2025-32050:
    A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content     via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to     a crafted HTTP response by an HTTP server.

    CVE-2025-32912:
    A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug     resulting in a buffer under-read.

    CVE-2025-32911:
    A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-     read.

    CVE-2025-32914:
    A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space()     functions may lead to a heap buffer over-read.

    CVE-2025-32908:
    A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP     server may cause the libsoup client to crash.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-     headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS).
    (CVE-2025-32908)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-1f41505af2 advisory.

    This update fixes these CVEs:
      CVE-2025-4948       CVE-2025-32908       CVE-2025-32907       CVE-2025-4969       CVE-2025-4945       CVE-2025-4476


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-99768b0fab advisory.

    This update fixes these CVEs:
      CVE-2025-4948       CVE-2025-32908       CVE-2025-32907       CVE-2025-4969       CVE-2025-4945       CVE-2025-4476


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-7505 advisory.

    - Fix CVE-2025-4035, CVE-2025-4948, CVE-2025-32049, CVE-2025-32907

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7505 advisory.

    Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access     Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate     packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This     enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion,     very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who     want it), but the SOAP parts were removed long ago.

    Security Fix(es):

    * libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784)

    * libsoup: Out of bounds reads in soup_headers_parse_request() (CVE-2025-32906)

    * libsoup: Denial of service on libsoup through HTTP/2 server (CVE-2025-32908)

    * libsoup: NULL pointer dereference in client when server  omits the nonce parameter in an Unauthorized     response with Digest  authentication (CVE-2025-32912)

    * libsoup: OOB Read on libsoup through function  soup_multipart_new_from_message in soup-multipart.c     leads to crash or  exit of process (CVE-2025-32914)

    * libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host     when being redirected by a server (CVE-2025-46421)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01504-1 advisory.

    - CVE-2025-2784: Fixed heap buffer over-read in `skip_insignificant_space` when sniffing conten     (bsc#1240750)
     - CVE-2025-32050: Fixed integer overflow in append_param_quoted (bsc#1240752)
     - CVE-2025-32051: Fixed segmentation fault when parsing malformed data URI (bsc#1240754)
     - CVE-2025-32052: Fixed heap buffer overflow in sniff_unknown() (bsc#1240756)
     - CVE-2025-32053: Fixed heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space()     (bsc#1240757)
     - CVE-2025-32906: Fixed out of bounds reads in soup_headers_parse_request() (bsc#1241263)
     - CVE-2025-32907: Fixed excessive memory consumption in server when client requests a large amount of     overlapping ranges in a single HTTP request (bsc#1241222)
     - CVE-2025-32908: Fixed HTTP request may lead to server crash due to HTTP/2 server not fully validating     the values of pseudo-headers (bsc#1241223)
     - CVE-2025-32909: Fixed NULL pointer dereference in the sniff_mp4 function in soup-content-sniffer.c     (bsc#1241226)
     - CVE-2025-32910: Fixed NULL pointer deference on client when server omits the realm parameter in an     Unauthorized response with Digest authentication (bsc#1241252)
     - CVE-2025-32911: Fixed double free on soup_message_headers_get_content_disposition() via 'params'     (bsc#1241238)
     - CVE-2025-32912: Fixed NULL pointer dereference in SoupAuthDigest (bsc#1241214)
     - CVE-2025-32913: Fixed NULL pointer dereference in soup_message_headers_get_content_disposition     (bsc#1241162)
     - CVE-2025-32914: Fixed out of bounds read in `soup_multipart_new_from_message()` (bsc#1241164)
     - CVE-2025-46420: Fixed memory leak on soup_header_parse_quality_list() via soup-headers.c (bsc#1241686)
     - CVE-2025-46421: Fixed HTTP Authorization Header leak via an HTTP redirect (bsc#1241688)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7543-1 advisory.

    Jan Raski discovered that libsoup incorrectly handled certain headers when sending HTTP/2 requests     over TLS. An attacker could possibly use this issue to cause a denial of service. This issue only affected     libsoup3 in Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2025-32908)

    Jan Raski discovered that libsoup incorrectly parsed certain response headers. An attacker could     possibly use this issue to cause a denial of service. (CVE-2025-4476)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the libsoup package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-961 advisory.

    A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource     consumption attack. This flaw allows a malicious client to request the same range many times in a single     HTTP request, causing the server to use large amounts of memory. (CVE-2025-32907)

    A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-     headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS).
    (CVE-2025-32908)

    A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-     of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of     bounds. (CVE-2025-32914)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1504-1 advisory.

    - CVE-2025-2784: Fixed heap buffer over-read in `skip_insignificant_space` when sniffing conten     (bsc#1240750)
     - CVE-2025-32050: Fixed integer overflow in append_param_quoted (bsc#1240752)
     - CVE-2025-32051: Fixed segmentation fault when parsing malformed data URI (bsc#1240754)
     - CVE-2025-32052: Fixed heap buffer overflow in sniff_unknown() (bsc#1240756)
     - CVE-2025-32053: Fixed heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space()     (bsc#1240757)
     - CVE-2025-32906: Fixed out of bounds reads in soup_headers_parse_request() (bsc#1241263)
     - CVE-2025-32907: Fixed excessive memory consumption in server when client requests a large amount of     overlapping ranges in a single HTTP request (bsc#1241222)
     - CVE-2025-32908: Fixed HTTP request may lead to server crash due to HTTP/2 server not fully validating     the values of pseudo-headers (bsc#1241223)
     - CVE-2025-32909: Fixed NULL pointer dereference in the sniff_mp4 function in soup-content-sniffer.c     (bsc#1241226)
     - CVE-2025-32910: Fixed NULL pointer deference on client when server omits the realm parameter in an     Unauthorized response with Digest authentication (bsc#1241252)
     - CVE-2025-32911: Fixed double free on soup_message_headers_get_content_disposition() via 'params'     (bsc#1241238)
     - CVE-2025-32912: Fixed NULL pointer dereference in SoupAuthDigest (bsc#1241214)
     - CVE-2025-32913: Fixed NULL pointer dereference in soup_message_headers_get_content_disposition     (bsc#1241162)
     - CVE-2025-32914: Fixed out of bounds read in `soup_multipart_new_from_message()` (bsc#1241164)
     - CVE-2025-46420: Fixed memory leak on soup_header_parse_quality_list() via soup-headers.c (bsc#1241686)
     - CVE-2025-46421: Fixed HTTP Authorization Header leak via an HTTP redirect (bsc#1241688)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
275938	TencentOS Server 4: libsoup3 (TSSA-2025:0587)	Nessus	Tencent Local Security Checks	medium
245039	Linux Distros Unpatched Vulnerability : CVE-2025-32908	Nessus	Misc.	high
244369	Fedora 41 : libsoup3 (2025-1f41505af2)	Nessus	Fedora Local Security Checks	medium
243317	Fedora 42 : libsoup3 (2025-99768b0fab)	Nessus	Fedora Local Security Checks	medium
241047	Oracle Linux 10 : libsoup3 (ELSA-2025-7505)	Nessus	Oracle Linux Local Security Checks	medium
237856	RHEL 10 : libsoup3 (RHSA-2025:7505)	Nessus	Red Hat Local Security Checks	high
237542	SUSE SLED15 / SLES15 Security Update : libsoup (SUSE-SU-2025:01504-1)	Nessus	SuSE Local Security Checks	medium
237450	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : libsoup vulnerabilities (USN-7543-1)	Nessus	Ubuntu Local Security Checks	medium
236799	Photon OS 5.0: Libsoup PHSA-2025-5.0-0522	Nessus	PhotonOS Local Security Checks	medium
235912	Amazon Linux 2023 : libsoup3, libsoup3-devel (ALAS2023-2025-961)	Nessus	Amazon Linux Local Security Checks	high
235644	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libsoup (SUSE-SU-2025:1504-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2025-32908

high

Tenable Plugins

medium

high

medium

medium

medium

high

medium

medium

medium

high

high