Critical Security Flaws in libsoup3: Integer Overflow and Out-of-Bounds Read Vulnerabilities
Summary
ALSA-2025:21032: Important: libsoup3 security update. Affects libsoup3 versions < 3.6.5-3.el10_1.6. Fixed in 3.6.5-3.el10_1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libsoup is an HTTP library implementation in C, designed to facilitate asynchronous network communication for GNOME applications. It allows developers to access HTTP servers seamlessly, integrating well with the GTK programming model. The library has been split from its original SOAP implementation, focusing solely on HTTP functionalities. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this library.
Vulnerability Detail
The vulnerabilities in libsoup3 include an Integer Overflow in Cookie Expiration Date Handling (CVE-2025-4945) and an Out-of-Bounds Read in Cookie Date Handling (CVE-2025-11021). These flaws can lead to unexpected behavior, potentially allowing attackers to exploit the library for unauthorized access or data manipulation. The Integer Overflow may result in incorrect calculations for cookie expiration, while the Out-of-Bounds Read could expose sensitive data or crash the application.
How To Fix
Minimum fixed version
3.6.5-3.el10_1.6
This is the first release that contains the fix.
sudo dnf update libsoup3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation for cookie data to mitigate the risks associated with these vulnerabilities. Additionally, avoid using the affected functionalities until the update can be applied.
Conclusion
The identified vulnerabilities in libsoup3 pose significant risks to applications relying on this library for HTTP communication. It is crucial to update to the latest patched version to safeguard against potential exploits. Implementing workarounds can provide temporary relief, but a permanent fix through updates is strongly recommended.
See every vulnerability recorded for libsoup3 →
FAQ
The main vulnerabilities are an Integer Overflow in Cookie Expiration Date Handling and an Out-of-Bounds Read in Cookie Date Handling.
These vulnerabilities can lead to unauthorized access, data manipulation, or application crashes, compromising the security and stability of your application.
Yes, a patch is available in version 3.6.5-3.el10_1.6 of libsoup3. It is recommended to update to this version.
Implement input validation for cookie data and avoid using the affected functionalities until the update can be applied.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup3.
