// For flags

CVE-2025-32050

Libsoup: integer overflow in append_param_quoted

Severity Score

5.9
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read.

This update for libsoup fixes the following issues. Fixed heap buffer over-read in 'skip_insignificant_space' when sniffing conten. Fixed integer overflow in append_param_quoted. Fixed segmentation fault when parsing malformed data URI Fixed heap buffer overflow in sniff_unknown. Fixed heap buffer overflows in sniff_feed_or_html and skip_insignificant_space. Fixed out of bounds reads in soup_headers_parse_request. Fixed excessive memory consumption in server when client requests a large amount of overlapping ranges in a single HTTP request. Fixed HTTP request may lead to server crash due to HTTP/2 server not fully validating the values of pseudo-headers. Fixed NULL pointer dereference in the sniff_mp4 function in soup-content-sniffer.c. Fixed NULL pointer deference on client when server omits the realm parameter in an Unauthorized response with Digest authentication. Fixed double free on soup_message_headers_get_content_disposition via "params" Fixed NULL pointer dereference in SoupAuthDigest. Fixed NULL pointer dereference in soup_message_headers_get_content_disposition. Fixed out of bounds read in 'soup_multipart_new_from_message'. Fixed memory leak on soup_header_parse_quality_list via soup-headers.c. Fixed HTTP Authorization Header leak via an HTTP redirect.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
High
Authentication
None
Confidentiality
None
Integrity
None
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2025-04-03 CVE Reserved
  • 2025-04-03 CVE Published
  • 2025-05-29 CVE Updated
  • 2025-06-10 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-127: Buffer Under-read
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Oracle
Search vendor "Oracle"
Linux
Search vendor "Oracle" for product "Linux"
*-
Affected
Red Hat
Search vendor "Red Hat"
Enterprise Linux
Search vendor "Red Hat" for product "Enterprise Linux"
*-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
*-
Affected
Redhat
Search vendor "Redhat"
Rhel Eus
Search vendor "Redhat" for product "Rhel Eus"
*-
Affected
Alibabacloud
Search vendor "Alibabacloud"
Alibaba Cloud Linux 3
Search vendor "Alibabacloud" for product "Alibaba Cloud Linux 3"
*-
Affected
Alma
Search vendor "Alma"
Linux
Search vendor "Alma" for product "Linux"
*-
Affected
Amazon
Search vendor "Amazon"
Linux
Search vendor "Amazon" for product "Linux"
*-
Affected
Canonical
Search vendor "Canonical"
Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
*-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
*-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
*-
Affected
Opensuse
Search vendor "Opensuse"
Leap
Search vendor "Opensuse" for product "Leap"
*-
Affected
Oracle
Search vendor "Oracle"
Linux
Search vendor "Oracle" for product "Linux"
*-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
*-
Affected
Redhat
Search vendor "Redhat"
Rhel Eus
Search vendor "Redhat" for product "Rhel Eus"
*-
Affected
Suse
Search vendor "Suse"
Sle-module-basesystem
Search vendor "Suse" for product "Sle-module-basesystem"
*-
Affected
Suse
Search vendor "Suse"
Sle Hpc-espos
Search vendor "Suse" for product "Sle Hpc-espos"
*-
Affected
Suse
Search vendor "Suse"
Sle Hpc-ltss
Search vendor "Suse" for product "Sle Hpc-ltss"
*-
Affected
Suse
Search vendor "Suse"
Sle Hpc
Search vendor "Suse" for product "Sle Hpc"
*-
Affected
Suse
Search vendor "Suse"
Sled
Search vendor "Suse" for product "Sled"
*-
Affected
Suse
Search vendor "Suse"
Sles-ltss-extended-security
Search vendor "Suse" for product "Sles-ltss-extended-security"
*-
Affected
Suse
Search vendor "Suse"
Sles-ltss
Search vendor "Suse" for product "Sles-ltss"
*-
Affected
Suse
Search vendor "Suse"
Sles
Search vendor "Suse" for product "Sles"
*-
Affected
Suse
Search vendor "Suse"
Sles Sap
Search vendor "Suse" for product "Sles Sap"
*-
Affected
Suse
Search vendor "Suse"
Suse-manager-proxy
Search vendor "Suse" for product "Suse-manager-proxy"
*-
Affected
Suse
Search vendor "Suse"
Suse-manager-server
Search vendor "Suse" for product "Suse-manager-server"
*-
Affected