{"id":"CVE-2025-32050","state":"PUBLISHED","title":"Libsoup: integer overflow in append_param_quoted","description":"A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read.","publishedAt":"2025-04-03T13:36:29.141Z","updatedAt":"2026-06-30T00:33:51.130Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["libsoup","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support","Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support","Red Hat Red Hat Enterprise Linux 10","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7"],"affected":[{"packageName":"libsoup","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.6.1","versionType":"semver"}],"collectionURL":"https://gitlab.gnome.org/GNOME/libsoup/"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-8.el8_10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/o:redhat:enterprise_linux:8::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"mingw-freetype","defaultStatus":"affected","versions":[{"version":"0:2.8-3.el8_10.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"spice-client-win","defaultStatus":"affected","versions":[{"version":"0:8.10-1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-8.el8_10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/o:redhat:enterprise_linux:8::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Extended Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-3.el8_8.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:8.8::appstream","cpe:/o:redhat:rhel_eus:8.8::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-10.el9_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Extended Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-8.el9_2.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-8.el9_4.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"libsoup3","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"libsoup","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"libsoup","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]}],"references":["https://access.redhat.com/errata/RHSA-2025:4440","https://access.redhat.com/errata/RHSA-2025:4508","https://access.redhat.com/errata/RHSA-2025:4560","https://access.redhat.com/errata/RHSA-2025:4568","https://access.redhat.com/errata/RHSA-2025:7436","https://access.redhat.com/errata/RHSA-2025:8292","https://access.redhat.com/security/cve/CVE-2025-32050","https://bugzilla.redhat.com/show_bug.cgi?id=2357067","https://gitlab.gnome.org/GNOME/libsoup/-/issues/424","https://lists.debian.org/debian-lts-announce/2025/04/msg00036.html"],"weaknesses":["CWE-127"],"ingestedAt":"2026-10-29T20:08:55.257Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/32xxx/CVE-2025-32050.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-32050","state":"PUBLISHED","datePublished":"2025-04-03T13:36:29.141Z","dateUpdated":"2026-06-30T00:33:51.130Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2025-04-03T01:42:14.135Z"},"containers":{"cna":{"title":"Libsoup: integer overflow in append_param_quoted","descriptions":[{"lang":"en","value":"A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read."}],"affected":[{"packageName":"libsoup","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.6.1","versionType":"semver"}],"collectionURL":"https://gitlab.gnome.org/GNOME/libsoup/"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-8.el8_10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/o:redhat:enterprise_linux:8::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"mingw-freetype","defaultStatus":"affected","versions":[{"version":"0:2.8-3.el8_10.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"spice-client-win","defaultStatus":"affected","versions":[{"version":"0:8.10-1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-8.el8_10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/o:redhat:enterprise_linux:8::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Extended Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.62.3-3.el8_8.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:8.8::appstream","cpe:/o:redhat:rhel_eus:8.8::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-10.el9_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Extended Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-8.el9_2.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-8.el9_4.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"libsoup3","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"libsoup","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"libsoup","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:4440","name":"RHSA-2025:4440","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:4508","name":"RHSA-2025:4508","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:4560","name":"RHSA-2025:4560","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:4568","name":"RHSA-2025:4568","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7436","name":"RHSA-2025:7436","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8292","name":"RHSA-2025:8292","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-32050","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2357067","name":"RHBZ#2357067","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/issues/424"}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-127","description":"Buffer Under-read","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-06-30T00:33:51.130Z"},"datePublic":"2025-04-03T00:00:00.000Z","x_redhatCweChain":"CWE-127: Buffer Under-read","workarounds":[{"lang":"en","value":"No mitigation is currently available for this vulnerability."}],"timeline":[{"lang":"en","time":"2025-04-03T01:17:42.454Z","value":"Reported to Red Hat."},{"lang":"en","time":"2025-04-03T00:00:00.000Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-03T14:56:24.491360Z","id":"CVE-2025-32050","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-03T14:57:28.366Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00036.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T19:53:14.249Z"}}]}}}