RHSA-2025:4538: Important: libsoup security update
Important: libsoup security update
Other sources
The libsoup packages provide an HTTP client and server library for GNOME.Security Fix(es): libsoup: Out of bounds reads in soupheadersparserequest() (CVE-2025-32906) libsoup: Double free on soupmessageheadersgetcontentdisposition() through "soup-message-headers.c" via "params" GHashTable value (CVE-2025-32911) libsoup: NULL pointer dereference in soupmessageheadersgetcontentdisposition when "filename" parameter is present, but has no value in Content-Disposition header (CVE-2025-32913) libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server (CVE-2025-46421) libsoup: Memory leak on soupheaderparsequalitylist() via soup-headers.c (CVE-2025-46420) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2025:4538?
The severity of RHSA-2025:4538 is classified as important.
What vulnerabilities are addressed in RHSA-2025:4538?
RHSA-2025:4538 addresses out of bounds reads in soup_headers_parse_request() and potential double free issues.
How do I fix RHSA-2025:4538?
To fix RHSA-2025:4538, you need to update the libsoup package to version 2.62.3-1.el8_2.4.
Which software versions are affected by RHSA-2025:4538?
Affected software versions for RHSA-2025:4538 include libsoup versions prior to 2.62.3-1.el8_2.4.
Is there a risk of exploitation with RHSA-2025:4538?
Yes, the vulnerabilities outlined in RHSA-2025:4538 could lead to potential exploitation if not patched.