{"id":"CVE-2025-32908","state":"PUBLISHED","title":"Libsoup: denial of service on libsoup through http/2 server","description":"A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS).","publishedAt":"2025-04-14T14:00:30.423Z","updatedAt":"2026-06-29T20:39:30.041Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["libsoup","Red Hat Red Hat Enterprise Linux 10","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 9"],"affected":[{"packageName":"libsoup","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.6.5","versionType":"semver"}],"collectionURL":"https://gitlab.gnome.org/GNOME/libsoup/"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"libsoup3","defaultStatus":"affected","versions":[{"version":"0:3.6.5-3.el10_0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"libsoup","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"libsoup","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"libsoup","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"libsoup","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]}],"references":["https://access.redhat.com/errata/RHSA-2025:7505","https://access.redhat.com/security/cve/CVE-2025-32908","https://bugzilla.redhat.com/show_bug.cgi?id=2359343","https://gitlab.gnome.org/GNOME/libsoup/-/issues/429","https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/451"],"weaknesses":["CWE-115"],"ingestedAt":"2026-10-29T20:08:55.257Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/32xxx/CVE-2025-32908.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-32908","state":"PUBLISHED","datePublished":"2025-04-14T14:00:30.423Z","dateUpdated":"2026-06-29T20:39:30.041Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2025-04-14T01:37:48.152Z"},"containers":{"cna":{"title":"Libsoup: denial of service on libsoup through http/2 server","descriptions":[{"lang":"en","value":"A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS)."}],"affected":[{"packageName":"libsoup","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.6.5","versionType":"semver"}],"collectionURL":"https://gitlab.gnome.org/GNOME/libsoup/"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"libsoup3","defaultStatus":"affected","versions":[{"version":"0:3.6.5-3.el10_0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"libsoup","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"libsoup","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"libsoup","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"libsoup","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:7505","name":"RHSA-2025:7505","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-32908","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359343","name":"RHBZ#2359343","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/issues/429"},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/451"}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-115","description":"Misinterpretation of Input","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-06-29T20:39:30.041Z"},"datePublic":"2025-04-14T00:00:00.000Z","x_redhatCweChain":"CWE-115: Misinterpretation of Input","workarounds":[{"lang":"en","value":"Currently, no mitigation was found for this vulnerability."}],"timeline":[{"lang":"en","time":"2025-04-14T01:27:09.097Z","value":"Reported to Red Hat."},{"lang":"en","time":"2025-04-14T00:00:00.000Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-14T14:12:19.790872Z","id":"CVE-2025-32908","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-14T18:06:53.056Z"}}]}}}