Critical Security Update for libsoup: Integer Overflow and Out-of-Bounds Read Vulnerabilities
Summary
ALSA-2025:19714: Important: libsoup security update. Affects libsoup versions < 2.62.3-10.el8_10. Fixed in 2.62.3-10.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libsoup is an HTTP client and server library for the GNOME desktop environment, providing essential functionalities for web communication. It is widely used in various applications to handle HTTP requests and responses efficiently. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this library.
Vulnerability Detail
The vulnerabilities in libsoup stem from an integer overflow in cookie expiration date handling (CVE-2025-4945) and an out-of-bounds read in cookie date handling (CVE-2025-11021). These issues could allow attackers to exploit the library, potentially leading to unauthorized access or data corruption. The integer overflow may result in incorrect handling of cookie expiration, while the out-of-bounds read could expose sensitive information or cause application crashes.
How To Fix
Minimum fixed version
2.62.3-10.el8_10
This is the first release that contains the fix.
sudo dnf update libsoupTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling any features that rely on cookie handling until the update can be applied. This may involve modifying application settings or configurations to avoid using cookies.
Conclusion
The identified vulnerabilities in libsoup highlight critical security risks that need to be addressed promptly. By updating to the latest patched version, users can protect their applications from potential exploitation. Utilizing tools like Vulert can further enhance security by providing real-time monitoring of vulnerabilities.
See every vulnerability recorded for libsoup →
FAQ
The main vulnerabilities are an integer overflow in cookie expiration date handling and an out-of-bounds read in cookie date handling.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
These vulnerabilities could lead to unauthorized access, data corruption, or application crashes, posing significant security risks.
Yes, a patch is available in version 2.62.3-10.el8_10 of the libsoup and libsoup-devel packages.
If you cannot update immediately, consider disabling features that rely on cookie handling as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup.
