{"id":"CVE-2025-32049","state":"PUBLISHED","title":"Libsoup: denial of service attack to websocket server","description":"A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).","publishedAt":"2025-04-03T13:36:13.035Z","updatedAt":"2026-06-30T00:33:49.421Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["libsoup","Red Hat Red Hat Enterprise Linux 10","Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support","Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service","Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support","Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support","Red Hat Red Hat Enterprise Linux 6"],"affected":[{"packageName":"libsoup","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.6.4","versionType":"semver"}],"collectionURL":"https://gitlab.gnome.org/GNOME/libsoup/"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"libsoup3","defaultStatus":"affected","versions":[{"version":"0:3.6.5-3.el10_0.6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.2-9.el7_9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.2-6.el7_9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-9.el8_10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/o:redhat:enterprise_linux:8::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-9.el8_10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/o:redhat:enterprise_linux:8::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.2 Advanced Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-1.el8_2.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.2::appstream","cpe:/o:redhat:rhel_aus:8.2::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-2.el8_4.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/o:redhat:rhel_aus:8.4::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-2.el8_6.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream","cpe:/o:redhat:rhel_aus:8.6::baseos","cpe:/o:redhat:rhel_e4s:8.6::baseos","cpe:/o:redhat:rhel_tus:8.6::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Telecommunications Update Service","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-2.el8_6.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream","cpe:/o:redhat:rhel_aus:8.6::baseos","cpe:/o:redhat:rhel_e4s:8.6::baseos","cpe:/o:redhat:rhel_tus:8.6::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-2.el8_6.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream","cpe:/o:redhat:rhel_aus:8.6::baseos","cpe:/o:redhat:rhel_e4s:8.6::baseos","cpe:/o:redhat:rhel_tus:8.6::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Extended Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-3.el8_8.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:8.8::appstream","cpe:/o:redhat:rhel_eus:8.8::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-10.el9_6.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-8.el9_0.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.0::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Extended Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-8.el9_2.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-8.el9_4.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"libsoup","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]}],"references":["https://access.redhat.com/errata/RHSA-2025:21657","https://access.redhat.com/errata/RHSA-2025:8126","https://access.redhat.com/errata/RHSA-2025:8128","https://access.redhat.com/errata/RHSA-2025:8132","https://access.redhat.com/errata/RHSA-2025:8139","https://access.redhat.com/errata/RHSA-2025:8140","https://access.redhat.com/errata/RHSA-2025:8252","https://access.redhat.com/errata/RHSA-2025:8480","https://access.redhat.com/errata/RHSA-2025:8481","https://access.redhat.com/errata/RHSA-2025:8482","https://access.redhat.com/errata/RHSA-2025:8663","https://access.redhat.com/errata/RHSA-2025:9179","https://access.redhat.com/security/cve/CVE-2025-32049","https://bugzilla.redhat.com/show_bug.cgi?id=2357066","https://gitlab.gnome.org/GNOME/libsoup/-/issues/390","https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/408"],"weaknesses":["CWE-770"],"ingestedAt":"2026-10-29T20:08:55.257Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/32xxx/CVE-2025-32049.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-32049","state":"PUBLISHED","datePublished":"2025-04-03T13:36:13.035Z","dateUpdated":"2026-06-30T00:33:49.421Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2025-04-03T01:42:14.134Z"},"containers":{"cna":{"title":"Libsoup: denial of service attack to websocket server","descriptions":[{"lang":"en","value":"A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS)."}],"affected":[{"packageName":"libsoup","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.6.4","versionType":"semver"}],"collectionURL":"https://gitlab.gnome.org/GNOME/libsoup/"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"libsoup3","defaultStatus":"affected","versions":[{"version":"0:3.6.5-3.el10_0.6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.2-9.el7_9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.2-6.el7_9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-9.el8_10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/o:redhat:enterprise_linux:8::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-9.el8_10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/o:redhat:enterprise_linux:8::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.2 Advanced Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-1.el8_2.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.2::appstream","cpe:/o:redhat:rhel_aus:8.2::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-2.el8_4.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/o:redhat:rhel_aus:8.4::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-2.el8_6.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream","cpe:/o:redhat:rhel_aus:8.6::baseos","cpe:/o:redhat:rhel_e4s:8.6::baseos","cpe:/o:redhat:rhel_tus:8.6::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Telecommunications Update Service","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-2.el8_6.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream","cpe:/o:redhat:rhel_aus:8.6::baseos","cpe:/o:redhat:rhel_e4s:8.6::baseos","cpe:/o:redhat:rhel_tus:8.6::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-2.el8_6.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream","cpe:/o:redhat:rhel_aus:8.6::baseos","cpe:/o:redhat:rhel_e4s:8.6::baseos","cpe:/o:redhat:rhel_tus:8.6::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Extended Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-3.el8_8.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:8.8::appstream","cpe:/o:redhat:rhel_eus:8.8::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-10.el9_6.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-8.el9_0.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.0::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Extended Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-8.el9_2.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-8.el9_4.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"libsoup","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:21657","name":"RHSA-2025:21657","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8126","name":"RHSA-2025:8126","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8128","name":"RHSA-2025:8128","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8132","name":"RHSA-2025:8132","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8139","name":"RHSA-2025:8139","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8140","name":"RHSA-2025:8140","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8252","name":"RHSA-2025:8252","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8480","name":"RHSA-2025:8480","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8481","name":"RHSA-2025:8481","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8482","name":"RHSA-2025:8482","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8663","name":"RHSA-2025:8663","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9179","name":"RHSA-2025:9179","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-32049","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2357066","name":"RHBZ#2357066","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/issues/390"},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/408"}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","description":"Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-06-30T00:33:49.421Z"},"datePublic":"2025-04-03T00:00:00.000Z","x_redhatCweChain":"CWE-770: Allocation of Resources Without Limits or Throttling","workarounds":[{"lang":"en","value":"No mitigation is currently available for this vulnerability."}],"timeline":[{"lang":"en","time":"2025-04-03T01:16:46.830Z","value":"Reported to Red Hat."},{"lang":"en","time":"2025-04-03T00:00:00.000Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-03T14:58:16.040953Z","id":"CVE-2025-32049","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-03T14:58:32.619Z"}}]}}}