CVE-2025-32906 – An out-of-bounds read vulnerability in libsoup'... (How to Fix)

Q: What is the severity of CVE-2025-32906?

CVE-2025-32906 has a CVSS score of 7.5 (HIGH). An out-of-bounds read vulnerability in libsoup's soup_headers_parse_request() function allows attackers to crash HTTP servers via specially crafted HTTP requests. This affects systems using vulnerable versions of libsoup for HTTP request processing. The vulnerability can lead to denial of service.

📋 TL;DR

An out-of-bounds read vulnerability in libsoup's soup_headers_parse_request() function allows attackers to crash HTTP servers via specially crafted HTTP requests. This affects systems using vulnerable versions of libsoup for HTTP request processing. The vulnerability can lead to denial of service.

💻 Affected Systems

Products:

libsoup
applications using libsoup for HTTP processing

Versions: Specific vulnerable versions not provided in references; check Red Hat advisories for exact ranges.

Operating Systems: Linux distributions using libsoup (Red Hat, Fedora, Ubuntu, etc.)

Default Config Vulnerable: ⚠️ Yes

Notes: Any application using libsoup's HTTP request parsing functionality is vulnerable when processing untrusted HTTP requests.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete HTTP server crash leading to denial of service for all web applications using the vulnerable libsoup library.

🟠

Likely Case

HTTP server crashes requiring restart, causing temporary service disruption for web applications.

🟢

If Mitigated

Minimal impact with proper network segmentation and request filtering in place.

🌐 Internet-Facing: HIGH - Internet-facing HTTP servers are directly exposed to malicious requests.

🏢 Internal Only: MEDIUM - Internal systems could be targeted by authenticated malicious users or compromised internal systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW - Crafting malicious HTTP requests is relatively simple.

The vulnerability requires sending specially crafted HTTP requests to trigger the out-of-bounds read.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check specific Red Hat advisories for patched versions.

Vendor Advisory: https://access.redhat.com/errata/RHSA-2025:21657

Restart Required: Yes

Instructions:

1. Check your distribution's package manager for libsoup updates. 2. Apply the security update for libsoup. 3. Restart any services using libsoup (including web servers). 4. Verify the update was successful.

🔧 Temporary Workarounds

Request Filtering

linux

Implement HTTP request filtering at the web server or load balancer level to block malformed requests.

# Example for nginx: location / { if ($invalid_request) { return 444; } }
# Example for Apache: RewriteEngine On, RewriteCond %{REQUEST_URI} ^.*malformed.* [NC], RewriteRule .* - [F]

Network Segmentation

linux

Restrict access to vulnerable HTTP servers to trusted networks only.

# Example iptables rule: iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP

🧯 If You Can't Patch

Implement web application firewalls (WAF) to filter malicious HTTP requests before they reach the vulnerable server.
Monitor server logs for unusual HTTP request patterns and implement rate limiting to reduce attack surface.

🔍 How to Verify

Check if Vulnerable:

Check libsoup version: rpm -q libsoup or dpkg -l | grep libsoup, then compare with patched versions in Red Hat advisories.

Check Version:

rpm -q libsoup  # Red Hat/Fedora or dpkg -l | grep libsoup  # Debian/Ubuntu

Verify Fix Applied:

After update, verify libsoup version matches patched version and test HTTP server functionality.

📡 Detection & Monitoring

Log Indicators:

HTTP server crash logs
Unusual HTTP request patterns with malformed headers
Increased error rates in web server logs

Network Indicators:

Spike in HTTP requests to specific endpoints
Unusual HTTP header patterns in network traffic

SIEM Query:

source="web_server_logs" AND (error="crash" OR error="segmentation fault") AND process="libsoup"

📊 Metadata

CVE ID: CVE-2025-32906

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-125

EPSS Score: 0.8% exploit probability (73.5th percentile)

Published: April 14, 2025

Last Updated: November 18, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-32906, you might also want to check these: