Moderate Security Vulnerability in libsoup3: Heap Use-After-Free Issue
Summary
ALSA-2025:23139: Moderate: libsoup3 security update. Affects libsoup3 versions < 3.6.5-3.el10_1.7. Fixed in 3.6.5-3.el10_1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libsoup is an HTTP library implementation in C, designed to facilitate asynchronous HTTP requests in GNOME applications. It allows developers to access HTTP servers seamlessly, leveraging the Glib main loop for efficient event handling. The library was originally part of a SOAP implementation but has since evolved into a standalone package, focusing on HTTP functionalities. This vulnerability arises from improper handling of message queues during HTTP/2 read completion, potentially leading to memory corruption.
Vulnerability Detail
The vulnerability identified as CVE-2025-12105 is a heap use-after-free issue in libsoup's message queue handling. This flaw can be exploited during the HTTP/2 read completion process, allowing an attacker to manipulate memory, potentially leading to application crashes or arbitrary code execution. The severity of this vulnerability is classified as moderate, indicating that while it may not be critical, it poses a significant risk to applications relying on libsoup for HTTP communications.
How To Fix
Minimum fixed version
3.6.5-3.el10_1.7
This is the first release that contains the fix.
sudo dnf update libsoup3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating is not immediately possible, consider disabling HTTP/2 support in applications using libsoup until the patch can be applied. This can help mitigate the risk of exploitation while a permanent fix is being implemented.
Conclusion
The libsoup3 security update addresses a moderate vulnerability related to heap use-after-free in HTTP/2 read completion. It is crucial for developers and system administrators to update to the patched version to mitigate potential risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libsoup3 →
FAQ
The vulnerability is a heap use-after-free issue that occurs during HTTP/2 read completion, which can lead to memory corruption.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to application crashes or arbitrary code execution, posing a risk to the integrity and security of the application.
Yes, a patch is available in version 3.6.5-3.el10_1.7 of libsoup3. It is recommended to update to this version or later.
If an immediate update is not possible, consider disabling HTTP/2 support in your applications as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup3.
