Description
A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High
Affected products
- GNOME / libsoup3.6.5
- RedHat / codeready_linux_builder10.0 – 10.0
- RedHat / codeready_linux_builder_for_arm6410.0_aarch64 – 10.0_aarch64
- RedHat / codeready_linux_builder_for_arm64_eus10.0_aarch64 – 10.0_aarch64
- RedHat / codeready_linux_builder_for_ibm_z_systems10.0_s390x – 10.0_s390x
- RedHat / codeready_linux_builder_for_ibm_z_systems_eus10.0_s390x – 10.0_s390x
- RedHat / codeready_linux_builder_for_power_little_endian10.0_ppc64le – 10.0_ppc64le
- RedHat / codeready_linux_builder_for_power_little_endian_eus10.0_ppc64le – 10.0_ppc64le
- RedHat / enterprise_linux8.0 – 8.0
- RedHat / enterprise_linux9.0 – 9.0
- RedHat / enterprise_linux10.0 – 10.0
- RedHat / enterprise_linux_eus8.8 – 8.8
- RedHat / enterprise_linux_eus9.2 – 9.2
- RedHat / enterprise_linux_eus9.4 – 9.4
- RedHat / enterprise_linux_eus9.6 – 9.6
- RedHat / enterprise_linux_eus10.0 – 10.0
- RedHat / enterprise_linux_for_arm_648.0_aarch64 – 8.0_aarch64
- RedHat / enterprise_linux_for_arm_649.0_aarch64 – 9.0_aarch64
- RedHat / enterprise_linux_for_arm_6410.0_aarch64 – 10.0_aarch64
- RedHat / enterprise_linux_for_arm_64_eus8.8_aarch64 – 8.8_aarch64
- RedHat / enterprise_linux_for_arm_64_eus9.2_aarch64 – 9.2_aarch64
- RedHat / enterprise_linux_for_arm_64_eus9.4_aarch64 – 9.4_aarch64
- RedHat / enterprise_linux_for_arm_64_eus9.6_aarch64 – 9.6_aarch64
- RedHat / enterprise_linux_for_arm_64_eus10.0_aarch64 – 10.0_aarch64
- RedHat / enterprise_linux_for_ibm_z_systems8.0_s390x – 8.0_s390x
- RedHat / enterprise_linux_for_ibm_z_systems9.0_s390x – 9.0_s390x
- RedHat / enterprise_linux_for_ibm_z_systems10.0_s390x – 10.0_s390x
- RedHat / enterprise_linux_for_ibm_z_systems_eus8.8_s390x – 8.8_s390x
- RedHat / enterprise_linux_for_ibm_z_systems_eus9.2_s390x – 9.2_s390x
- RedHat / enterprise_linux_for_ibm_z_systems_eus9.4_s390x – 9.4_s390x
- RedHat / enterprise_linux_for_ibm_z_systems_eus9.6_s390x – 9.6_s390x
- RedHat / enterprise_linux_for_ibm_z_systems_eus10.0_s390x – 10.0_s390x
- RedHat / enterprise_linux_for_power_little_endian8.0_ppc64le – 8.0_ppc64le
- RedHat / enterprise_linux_for_power_little_endian9.0_ppc64le – 9.0_ppc64le
- RedHat / enterprise_linux_for_power_little_endian10.0_ppc64le – 10.0_ppc64le
- RedHat / enterprise_linux_for_power_little_endian_eus8.8_ppc64le – 8.8_ppc64le
- RedHat / enterprise_linux_for_power_little_endian_eus9.2_ppc64le – 9.2_ppc64le
- RedHat / enterprise_linux_for_power_little_endian_eus9.4_ppc64le – 9.4_ppc64le
- RedHat / enterprise_linux_for_power_little_endian_eus9.6_ppc64le – 9.6_ppc64le
- RedHat / enterprise_linux_for_power_little_endian_eus10.0_ppc64le – 10.0_ppc64le
- RedHat / enterprise_linux_server7.0 – 7.0
- RedHat / enterprise_linux_server_aus8.2 – 8.2
- RedHat / enterprise_linux_server_aus8.4 – 8.4
- RedHat / enterprise_linux_server_aus8.6 – 8.6
- RedHat / enterprise_linux_server_aus9.2 – 9.2
- RedHat / enterprise_linux_server_aus9.4 – 9.4
- RedHat / enterprise_linux_server_aus9.6 – 9.6
- RedHat / enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions8.6_ppc64le – 8.6_ppc64le
- RedHat / enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions9.0_ppc64le – 9.0_ppc64le
- RedHat / enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions9.6_ppc64le – 9.6_ppc64le
- RedHat / enterprise_linux_server_tus8.6 – 8.6
- RedHat / enterprise_linux_server_tus8.8 – 8.8
- RedHat / enterprise_linux_update_services_for_sap_solutions8.8 – 8.8
- RedHat / enterprise_linux_update_services_for_sap_solutions9.0 – 9.0
- RedHat / enterprise_linux_update_services_for_sap_solutions9.2 – 9.2
- RedHat / enterprise_linux_update_services_for_sap_solutions9.4 – 9.4
- RedHat / enterprise_linux_update_services_for_sap_solutions9.6 – 9.6
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:21657
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:7505
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:8126
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:8132
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:8139
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:8140
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:8252
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:8480
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:8481
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:8482
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:8663
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:9179
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2025-2784
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2354669
- MISChttps://gitlab.gnome.org/GNOME/libsoup/-/issues/422
Updated 19m ago · 8 sources