{"id":"CVE-2025-32907","state":"PUBLISHED","title":"Libsoup: denial of service in server when client requests a large amount of  overlapping ranges with range header","description":"A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service.","publishedAt":"2025-04-14T14:00:09.723Z","updatedAt":"2026-06-30T00:34:16.463Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"redhat"},"assigner":"redhat","products":["libsoup","Red Hat Red Hat Enterprise Linux 10","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support","Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7"],"affected":[{"packageName":"libsoup","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.6.5","versionType":"semver"}],"collectionURL":"https://gitlab.gnome.org/GNOME/libsoup/"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"libsoup3","defaultStatus":"affected","versions":[{"version":"0:3.6.5-3.el10_0.6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"mingw-freetype","defaultStatus":"affected","versions":[{"version":"0:2.8-3.el8_10.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"spice-client-win","defaultStatus":"affected","versions":[{"version":"0:8.10-1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-10.el9_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-8.el9_0.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.0::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Extended Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-8.el9_2.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-8.el9_4.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"libsoup","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"libsoup","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"libsoup","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]}],"references":["https://access.redhat.com/errata/RHSA-2025:4439","https://access.redhat.com/errata/RHSA-2025:4440","https://access.redhat.com/errata/RHSA-2025:4508","https://access.redhat.com/errata/RHSA-2025:7436","https://access.redhat.com/errata/RHSA-2025:8128","https://access.redhat.com/errata/RHSA-2025:8292","https://access.redhat.com/security/cve/CVE-2025-32907","https://bugzilla.redhat.com/show_bug.cgi?id=2359342","https://gitlab.gnome.org/GNOME/libsoup/-/issues/428"],"weaknesses":["CWE-1050"],"ingestedAt":"2026-10-29T20:08:55.257Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/32xxx/CVE-2025-32907.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-32907","state":"PUBLISHED","datePublished":"2025-04-14T14:00:09.723Z","dateUpdated":"2026-06-30T00:34:16.463Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2025-04-14T01:37:48.152Z"},"containers":{"cna":{"title":"Libsoup: denial of service in server when client requests a large amount of  overlapping ranges with range header","descriptions":[{"lang":"en","value":"A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service."}],"affected":[{"packageName":"libsoup","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.6.5","versionType":"semver"}],"collectionURL":"https://gitlab.gnome.org/GNOME/libsoup/"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"libsoup3","defaultStatus":"affected","versions":[{"version":"0:3.6.5-3.el10_0.6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"mingw-freetype","defaultStatus":"affected","versions":[{"version":"0:2.8-3.el8_10.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"spice-client-win","defaultStatus":"affected","versions":[{"version":"0:8.10-1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-10.el9_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-8.el9_0.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.0::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Extended Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-8.el9_2.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","packageName":"libsoup","defaultStatus":"affected","versions":[{"version":"0:2.72.0-8.el9_4.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"libsoup","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"libsoup","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"libsoup","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:4439","name":"RHSA-2025:4439","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:4440","name":"RHSA-2025:4440","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:4508","name":"RHSA-2025:4508","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7436","name":"RHSA-2025:7436","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8128","name":"RHSA-2025:8128","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8292","name":"RHSA-2025:8292","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-32907","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359342","name":"RHBZ#2359342","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/issues/428"}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1050","description":"Excessive Platform Resource Consumption within a Loop","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-06-30T00:34:16.463Z"},"datePublic":"2025-04-14T00:00:00.000Z","x_redhatCweChain":"CWE-1050: Excessive Platform Resource Consumption within a Loop","workarounds":[{"lang":"en","value":"Currently, no mitigation was found for this vulnerability."}],"timeline":[{"lang":"en","time":"2025-04-14T01:27:08.699Z","value":"Reported to Red Hat."},{"lang":"en","time":"2025-04-14T00:00:00.000Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-14T14:13:20.381645Z","id":"CVE-2025-32907","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-14T18:06:39.339Z"}}]}}}