Riskcovery

CVE-2025-4948

Libsoup: integer underflow in soup_multipart_new_from_message() leading to denial of service in libsoup

State
Published
Severity
7.5 High
Published
May 19, 2025
Updated
Jun 30, 2026
Reserved
May 19, 2025

Read the record on cve.org

Description

A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart messages. Due to improper validation, an internal calculation can go wrong, leading to an integer underflow. This can cause the program to access invalid memory and crash. As a result, any application or server using libsoup could be forced to exit unexpectedly, creating a denial-of-service (DoS) risk.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hredhat

Weaknesses

  • CWE-191 Integer Underflow (Wrap or Wraparound)

Affected Products

ProductVersions
libsoup
  • 3.6.5 and earlierAffected
Red Hat Enterprise Linux 10Red Hat
  • 0:3.6.5-3.el10_0.6 and laterNot affected
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat
  • 0:2.62.2-9.el7_9 and laterNot affected
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat
  • 0:2.62.2-6.el7_9 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 0:2.62.3-9.el8_10 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 0:2.62.3-9.el8_10 and laterNot affected
Red Hat Enterprise Linux 8.2 Advanced Update SupportRed Hat
  • 0:2.62.3-1.el8_2.5 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat
  • 0:2.62.3-2.el8_4.5 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat
  • 0:2.62.3-2.el8_6.5 and laterNot affected
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat
  • 0:2.62.3-2.el8_6.5 and laterNot affected
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat
  • 0:2.62.3-2.el8_6.5 and laterNot affected
Red Hat Enterprise Linux 8.8 Extended Update SupportRed Hat
  • 0:2.62.3-3.el8_8.5 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:2.72.0-10.el9_6.2 and laterNot affected
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRed Hat
  • 0:2.72.0-8.el9_0.5 and laterNot affected
Red Hat Enterprise Linux 9.2 Extended Update SupportRed Hat
  • 0:2.72.0-8.el9_2.5 and laterNot affected
Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat
  • 0:2.72.0-8.el9_4.5 and laterNot affected
Red Hat Enterprise Linux 6Red Hat

    References

    Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.