CVE-2025-46420: Libsoup: memory leak on soup_header_parse_quality_list() via soup-headers.c
A flaw was found in libsoup. It is vulnerable to memory leaks in the soupheaderparsequalitylist() function when parsing a quality list that contains elements with all zeroes.
Other sources
libsoup prior to version 3.6.3 is vulnerable to a memory leak in the soupheaderparsequalitylist() function when parsing a quality list if any element contains all zeroes, i.e. q=0.0 , q=0.00 , q=0.000, and so forth.
— Red Hat
Libsoup: memory leak on soupheaderparsequalitylist() via soup-headers.c
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libsoup2.4to a version that resolves this vulnerability.Fixed in 2.74.3-10.1 - Upgrade
Upgrade
debian/libsoup3to a version that resolves this vulnerability.Fixed in 3.6.5-1 - Upgrade
Upgrade
libsoupto a version that resolves this vulnerability.Fixed in 3.6.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46420?
CVE-2025-46420 is classified as a memory leak vulnerability, which can lead to increased resource consumption.
How do I fix CVE-2025-46420?
To fix CVE-2025-46420, update libsoup to version 3.6.3 or later.
What software versions are affected by CVE-2025-46420?
CVE-2025-46420 affects libsoup versions prior to 3.6.3.
What impact does CVE-2025-46420 have on application performance?
CVE-2025-46420 can lead to memory leaks, potentially degrading application performance over time.
Is CVE-2025-46420 a critical vulnerability?
Although CVE-2025-46420 is impactful due to memory leaks, it is not classified as critical.