CVE-2025-4948 – An integer underflow vulnerability in libsoup's... (How to Fix)

Q: What is the severity of CVE-2025-4948?

CVE-2025-4948 has a CVSS score of 7.5 (HIGH). An integer underflow vulnerability in libsoup's soup_multipart_new_from_message() function allows specially crafted multipart messages to cause memory access violations and application crashes. This affects any application or server using libsoup for HTTP communications, particularly GNOME applications and web services. The primary risk is denial-of-service (DoS) through forced application termination.

📋 TL;DR

An integer underflow vulnerability in libsoup's soup_multipart_new_from_message() function allows specially crafted multipart messages to cause memory access violations and application crashes. This affects any application or server using libsoup for HTTP communications, particularly GNOME applications and web services. The primary risk is denial-of-service (DoS) through forced application termination.

💻 Affected Systems

Products:

libsoup
GNOME applications using libsoup
web servers/services using libsoup

Versions: Specific versions not provided in CVE description; check Red Hat advisories for exact ranges

Operating Systems: Linux distributions with GNOME/libraries, Any OS running affected libsoup versions

Default Config Vulnerable: ⚠️ Yes

Notes: Any application using libsoup's multipart message parsing functionality is vulnerable by default when processing HTTP requests.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Critical services using libsoup crash repeatedly, causing sustained denial-of-service and potential data loss from interrupted operations.

🟠

Likely Case

Applications crash when processing malicious multipart messages, causing temporary service disruption until restarted.

🟢

If Mitigated

With proper input validation and memory protection mechanisms, crashes are contained without privilege escalation or data compromise.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending specially crafted multipart messages to vulnerable endpoints, which is straightforward for network-accessible services.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check specific Red Hat advisories (RHSA-2025:21657, etc.) for patched versions

Vendor Advisory: https://access.redhat.com/errata/RHSA-2025:21657

Restart Required: Yes

Instructions:

1. Identify affected libsoup packages. 2. Apply vendor patches via package manager (yum update libsoup, apt upgrade libsoup). 3. Restart affected applications/services.

🔧 Temporary Workarounds

Input filtering

all

Filter or reject multipart messages at network perimeter or application layer

Process isolation

linux

Run vulnerable applications in containers with resource limits to contain crashes

docker run --memory=512m --cpus=1 your_app

🧯 If You Can't Patch

Implement WAF rules to block suspicious multipart messages
Use load balancers with health checks to automatically restart crashed services

🔍 How to Verify

Check if Vulnerable:

Check libsoup package version against patched versions in Red Hat advisories

Check Version:

rpm -q libsoup || dpkg -l | grep libsoup || pkg-config --modversion libsoup-2.4

Verify Fix Applied:

Verify libsoup package version matches patched version from vendor advisory

📡 Detection & Monitoring

Log Indicators:

Application crashes with segmentation faults
Memory access violation errors in system logs
Unexpected process terminations

Network Indicators:

Unusual multipart HTTP requests
Repeated requests causing service restarts

SIEM Query:

process:terminated AND (libsoup OR application_name) AND signal:SIGSEGV

📊 Metadata

CVE ID: CVE-2025-4948

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-191

EPSS Score: 0.25% exploit probability (48.2th percentile)

Published: May 19, 2025

Last Updated: November 18, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-4948, you might also want to check these: