CVE-2025-32911 – A use-after-free vulnerability in libsoup's sou... (How to Fix)

Q: What is the severity of CVE-2025-32911?

CVE-2025-32911 has a CVSS score of 9.0 (CRITICAL). A use-after-free vulnerability in libsoup's soup_message_headers_get_content_disposition() function allows malicious HTTP clients to cause memory corruption in servers using libsoup. This affects any application or service that uses libsoup for HTTP communication, particularly web servers and applications handling HTTP requests.

📋 TL;DR

A use-after-free vulnerability in libsoup's soup_message_headers_get_content_disposition() function allows malicious HTTP clients to cause memory corruption in servers using libsoup. This affects any application or service that uses libsoup for HTTP communication, particularly web servers and applications handling HTTP requests.

💻 Affected Systems

Products:

libsoup
applications using libsoup (GNOME applications, web services, etc.)

Versions: Specific versions not detailed in references; check Red Hat advisories for affected ranges.

Operating Systems: Linux distributions (Red Hat, Fedora, Ubuntu, etc.)

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability is triggered when processing malicious HTTP requests with crafted Content-Disposition headers.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, data theft, or service disruption.

🟠

Likely Case

Denial of service through application crashes or memory corruption leading to instability.

🟢

If Mitigated

Limited impact with proper memory protections and exploit mitigations in place.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires sending malicious HTTP requests; complexity depends on memory layout and mitigations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check specific Red Hat advisories (e.g., RHSA-2025:21657) for patched versions.

Vendor Advisory: https://access.redhat.com/errata/RHSA-2025:21657

Restart Required: Yes

Instructions:

1. Update libsoup package via system package manager. 2. Restart affected services or applications using libsoup. 3. Verify the update with version checks.

🔧 Temporary Workarounds

Network Filtering

all

Block or filter malicious HTTP requests with abnormal Content-Disposition headers using a web application firewall (WAF) or network filter.

🧯 If You Can't Patch

Isolate affected systems from untrusted networks to reduce attack surface.
Implement strict input validation and sanitization for HTTP headers in applications.

🔍 How to Verify

Check if Vulnerable:

Check libsoup version against patched versions in Red Hat advisories; if unpatched, assume vulnerable.

Check Version:

rpm -q libsoup (on Red Hat-based systems) or dpkg -l libsoup* (on Debian-based systems)

Verify Fix Applied:

Verify libsoup package version matches or exceeds patched version from vendor advisories.

📡 Detection & Monitoring

Log Indicators:

Application crashes or abnormal termination logs from services using libsoup.
Unusual HTTP request patterns with malformed headers.

Network Indicators:

HTTP requests with crafted Content-Disposition headers targeting libsoup services.

SIEM Query:

source="application_logs" AND (event="crash" OR event="segfault") AND process="libsoup"

📊 Metadata

CVE ID: CVE-2025-32911

CVSS v3 Score: 9.0 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-590

EPSS Score: 0.61% exploit probability (69.3th percentile)

Published: April 15, 2025

Last Updated: November 18, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-32911, you might also want to check these: