CVE-2025-46420 – A memory leak vulnerability in libsoup's soup

Q: What is the severity of CVE-2025-46420?

CVE-2025-46420 has a CVSS score of 6.5 (MEDIUM). A memory leak vulnerability in libsoup's soup_header_parse_quality_list() function allows attackers to cause denial of service by sending specially crafted HTTP requests containing quality lists with all-zero elements. This affects applications using vulnerable versions of libsoup for HTTP communication.

📋 TL;DR

A memory leak vulnerability in libsoup's soup_header_parse_quality_list() function allows attackers to cause denial of service by sending specially crafted HTTP requests containing quality lists with all-zero elements. This affects applications using vulnerable versions of libsoup for HTTP communication.

💻 Affected Systems

Products:

libsoup
applications using libsoup for HTTP communication

Versions: Specific vulnerable versions not specified in CVE, but Red Hat advisories indicate affected versions in their distributions

Operating Systems: Linux distributions including Red Hat Enterprise Linux and derivatives

Default Config Vulnerable: ⚠️ Yes

Notes: Any application using libsoup to parse HTTP quality headers (like Accept, Accept-Encoding) is potentially vulnerable.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Sustained exploitation could lead to memory exhaustion, causing application crashes or system instability through denial of service.

🟠

Likely Case

Memory consumption increases over time under attack, potentially degrading application performance until restart is required.

🟢

If Mitigated

With proper monitoring and resource limits, impact is limited to temporary performance degradation before detection and remediation.

🌐 Internet-Facing: MEDIUM - Internet-facing services using libsoup are vulnerable to DoS attacks via crafted HTTP requests.

🏢 Internal Only: LOW - Internal systems are less likely to receive malicious crafted requests unless compromised internally.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW - Crafting HTTP requests with specific quality values is straightforward.

Exploitation requires sending HTTP requests to applications using vulnerable libsoup versions.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check specific Red Hat advisories for patched versions (RHSA-2025:4439, RHSA-2025:4440, etc.)

Vendor Advisory: https://access.redhat.com/errata/RHSA-2025:4439

Restart Required: Yes

Instructions:

1. Update libsoup package using system package manager. 2. For Red Hat systems: 'yum update libsoup'. 3. Restart affected applications/services using libsoup.

🔧 Temporary Workarounds

Rate limiting

all

Implement HTTP request rate limiting to reduce impact of DoS attempts

Memory monitoring

linux

Monitor memory usage of applications using libsoup and restart if abnormal growth detected

🧯 If You Can't Patch

Implement network filtering to block suspicious HTTP requests containing quality headers with all-zero values
Deploy reverse proxies with request sanitization to strip or normalize problematic quality headers

🔍 How to Verify

Check if Vulnerable:

Check libsoup version: 'rpm -q libsoup' (RHEL) or 'dpkg -l libsoup*' (Debian/Ubuntu) and compare against patched versions in advisories.

Check Version:

rpm -q libsoup || dpkg -l libsoup*

Verify Fix Applied:

Verify updated version: 'rpm -q libsoup' should show patched version. Test with crafted requests to ensure no memory growth.

📡 Detection & Monitoring

Log Indicators:

Unusual memory consumption patterns in application logs
Application crashes or restarts related to memory exhaustion

Network Indicators:

HTTP requests containing quality headers (Accept, Accept-Encoding) with unusual values
Repeated requests from single sources

SIEM Query:

source=application_logs memory_usage>threshold OR process_restart

📊 Metadata

CVE ID: CVE-2025-46420

CVSS v3 Score: 6.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE: CWE-401

EPSS Score: 0.3% exploit probability (53.2th percentile)

Published: April 24, 2025

Last Updated: July 28, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-46420, you might also want to check these: