- Vulnerability/
- USN-7490-3
USN-7490-3: libsoup vulnerabilities
First published: Wed May 07 2025(Updated: )
USN-7490-1 fixed vulnerabilities in libsoup2.4. This update provides the corresponding updates for libsoup3. Original advisory details: Tan Wei Chong discovered that libsoup incorrectly handled memory when parsing HTTP request headers. An attacker could possibly use this issue to send a maliciously crafted HTTP request to the server, causing a denial of service. (CVE-2025-32906) Alon Zahavi discovered that libsoup incorrectly parsed video files. An attacker could possibly use this issue to send a maliciously crafted HTTP response back to the client, causing a denial of service, or leading to undefined behavior. (CVE-2025-32909) Jan Różański discovered that libsoup incorrectly handled memory when parsing authentication headers. An attacker could possibly use this issue to send a maliciously crafted HTTP response back to the client, causing a denial of service. (CVE-2025-32910, CVE-2025-32912) It was discovered that libsoup incorrectly handled data in the hash table data type. An attacker could possibly use this issue to send a maliciously crafted HTTP request to the server, causing a denial of service or remote code execution. (CVE-2025-32911) Jan Różański discovered that libsoup incorrectly handled memory when parsing the content disposition HTTP header. An attacker could possibly use this issue to send maliciously crafted data to a client or server, causing a denial of service. (CVE-2025-32913) Alon Zahavi discovered that libsoup incorrectly handled memory when parsing HTTP requests. An attacker could possibly use this issue to send a maliciously crafted HTTP request to the server, causing a denial of service or obtaining sensitive information. (CVE-2025-32914) It was discovered that libsoup incorrectly handled memory when parsing quality-list headers. An attacker could possibly use this issue to send a maliciously crafted HTTP request to the server, causing a denial of service. (CVE-2025-46420) Jan Różański discovered that libsoup did not strip authorization information upon redirects. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-46421)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/libsoup-3.0-0 | <3.6.0-2ubuntu0.3 | 3.6.0-2ubuntu0.3 |
| Ubuntu | =24.10 | |
| All of | ||
| ubuntu/libsoup-3.0-0 | <3.4.4-5ubuntu0.3 | 3.4.4-5ubuntu0.3 |
| Ubuntu | =24.04 | |
| All of | ||
| ubuntu/libsoup-3.0-0 | <3.0.7-0ubuntu1+esm3 | 3.0.7-0ubuntu1+esm3 |
| Ubuntu | =22.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2025-32913
- https://ubuntu.com/security/CVE-2025-32909
- https://ubuntu.com/security/CVE-2025-32906
- https://ubuntu.com/security/CVE-2025-46421
- https://ubuntu.com/security/CVE-2025-32910
- https://ubuntu.com/security/CVE-2025-32912
- https://ubuntu.com/security/CVE-2025-32911
- https://ubuntu.com/security/CVE-2025-46420
- https://ubuntu.com/security/CVE-2025-32914
- https://ubuntu.com/security/notices/USN-7490-1
- https://ubuntu.com/security/notices/USN-7490-2
- https://launchpad.net/ubuntu/+source/libsoup3/3.6.0-2ubuntu0.3
- https://launchpad.net/ubuntu/+source/libsoup3/3.4.4-5ubuntu0.3
- https://ubuntu.com/security/notices/USN-7490-3 (Advisory)
Child vulnerabilities
(Contains the following vulnerabilities)
Frequently Asked Questions
What is the severity of USN-7490-3?
The severity of USN-7490-3 is high due to potential vulnerabilities in libsoup that could allow attackers to exploit the HTTP request header parsing.
How do I fix USN-7490-3?
To fix USN-7490-3, update libsoup to version 3.6.0-2ubuntu0.3 or later for Ubuntu 24.10, 3.4.4-5ubuntu0.3 or later for Ubuntu 24.04, or 3.0.7-0ubuntu1+esm3 or later for Ubuntu 22.04.
Which versions of libsoup are affected by USN-7490-3?
Versions of libsoup below 3.6.0-2ubuntu0.3 for Ubuntu 24.10, 3.4.4-5ubuntu0.3 for Ubuntu 24.04, and 3.0.7-0ubuntu1+esm3 for Ubuntu 22.04 are affected by USN-7490-3.
What type of vulnerability is detailed in USN-7490-3?
USN-7490-3 details a memory handling vulnerability in libsoup that occurs during the parsing of HTTP request headers.
Is USN-7490-3 specific to a particular Linux distribution?
Yes, USN-7490-3 is specific to Ubuntu and affects various versions of the libsoup package in that distribution.
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- agent/title
- agent/references
- agent/source
- agent/last-modified-date
- agent/tags
- agent/description
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/event
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu
- version/ubuntu/24.10
- version/ubuntu/24.04
- version/ubuntu/22.04