9.0 Critical

CVE-2025-32911 Libsoup: double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" ghashtable value

Description

A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: High
Privileges required: None
Interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
Red Hat Enterprise Linux 7 Extended Lifecycle Support	Versions not published
Red Hat Enterprise Linux 8	Versions not published
Red Hat Enterprise Linux 8.2 Advanced Update Support	Versions not published
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Versions not published
Red Hat Enterprise Linux 8.4 Telecommunications Update Service	Versions not published
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	Versions not published
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Versions not published
Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Versions not published
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Versions not published

Show the 8 other branches

Product	Affected versions	Fixed in
Red Hat Enterprise Linux 8.8 Extended Update Support	Versions not published
Red Hat Enterprise Linux 9	Versions not published
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Versions not published
Red Hat Enterprise Linux 9.2 Extended Update Support	Versions not published
Red Hat Enterprise Linux 9.4 Extended Update Support	Versions not published
Red Hat Enterprise Linux 10	Versions not published
Red Hat Enterprise Linux 6	Versions not published
Red Hat In-Vehicle Operating System 1	Versions not published

References

RHSA-2025:21657 access.redhat.com
RHSA-2025:4439 access.redhat.com
RHSA-2025:4440 access.redhat.com
RHSA-2025:4508 access.redhat.com
RHSA-2025:4538 access.redhat.com
RHSA-2025:4560 access.redhat.com
RHSA-2025:4568 access.redhat.com
RHSA-2025:4609 access.redhat.com
RHSA-2025:4624 access.redhat.com
RHSA-2025:7436 access.redhat.com
RHSA-2025:8292 access.redhat.com
access.redhat.com access.redhat.com
RHBZ#2359355 bugzilla.redhat.com
gitlab.gnome.org gitlab.gnome.org

Timeline

Published April 15, 2025
Last modified November 4, 2026

The 373 CVEs of Red Hat Enterprise Linux 7 Extended Lifecycle Support →

CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Medium CVE-2026-102559 Libsoup: libsoup: heap buffer overflow during websocket client-frame masking 8.6 High CVE-2026-102558 Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth 8.6 High CVE-2026-102557 Libsoup: libsoup: heap buffer overflow during websocket message reassembly 8.6 High

Track this CVE