ALSA-2025:8128

Source
https://errata.almalinux.org/10/ALSA-2025-8128.html
Import Source
https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux10/ALSA-2025:8128.json
JSON Data
https://api.osv.dev/v1/vulns/ALSA-2025:8128
Related
Published
2025-05-26T00:00:00Z
Modified
2025-05-29T10:09:38Z
Summary
Important: libsoup3 security update
Details

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

  • libsoup: Denial of Service attack to websocket server (CVE-2025-32049)
  • libsoup: Denial of service in server when client requests a large amount of overlapping ranges with Range header (CVE-2025-32907)
  • libsoup: Cookie domain validation bypass via uppercase characters in libsoup (CVE-2025-4035)
  • libsoup: Integer Underflow in soupmultipartnewfrommessage() Leading to Denial of Service in libsoup (CVE-2025-4948)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

Affected packages

AlmaLinux:10 / libsoup3

Package

Name
libsoup3
Purl
pkg:rpm/almalinux/libsoup3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.6.5-3.el10_0.6

AlmaLinux:10 / libsoup3-devel

Package

Name
libsoup3-devel
Purl
pkg:rpm/almalinux/libsoup3-devel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.6.5-3.el10_0.6

AlmaLinux:10 / libsoup3-doc

Package

Name
libsoup3-doc
Purl
pkg:rpm/almalinux/libsoup3-doc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.6.5-3.el10_0.6