CVE-2024-52531

A flaw was found in the libsoup library. Decoding specially crafted UTF-8 input data with the soup_header_parse_param_list_strict function can cause a heap-based buffer overflow, potentially resulting in code execution and denial of service to applications linked to the library.

Further investigation found that this issue can be exploited remotely, increasing the possibility of exploitation and the severity of this vulnerability.

Only applications that decode UTF-8 input data with the soup_header_parse_param_list_strict function are vulnerable to this issue.

Furthermore, exploitation of this vulnerability highly depends on the application code, the heap layout and functionalities exposed to an attacker. For this reason, this flaw has been rated with an Important severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.