CVE-2025-32908: Libsoup: denial of service on libsoup through http/2 server
A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS).
Other sources
Libsoup: denial of service on libsoup through http/2 server
— Microsoft
libsoup's HTTP/2 server doesn't fully validate the values of the pseudo-headers :scheme, :authority, and :path. A client may crash the server by sending a malicious HTTP request.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32908?
CVE-2025-32908 is categorized as a Denial of Service (DoS) vulnerability.
How does CVE-2025-32908 affect libsoup?
CVE-2025-32908 affects libsoup's HTTP/2 server, which may not fully validate certain pseudo-header values.
What are the affected versions of libsoup for CVE-2025-32908?
CVE-2025-32908 affects all versions of libsoup that utilize the HTTP/2 server.
How do I fix CVE-2025-32908?
To fix CVE-2025-32908, update to the latest version of libsoup that addresses the vulnerability.
What should I do if I can't update libsoup to mitigate CVE-2025-32908?
If unable to update, consider implementing network security measures to limit exposure to the affected HTTP/2 server.