CVE-2025-32053

A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read.

A moderate severity vulnerability was found in libsoup, where heap buffer over-reads can occur in the content sniffer's sniff_feed_or_html() and skip_insignificant_space() functions. A remote attacker who controls an HTTP server that a libsoup-based client connects to could send a crafted HTTP response that causes the client to read out of bounds, potentially resulting in a crash or exposure of out-of-bounds heap memory contents. Red Hat has rated this flaw Moderate severity with a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), consistent with the upstream assessment. The libsoup package as shipped in Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat In-Vehicle OS is affected, and fixes are being pursued through the respective product maintenance streams. Red Hat Enterprise Linux 10, which ships the libsoup3 package, is not affected because the vulnerable code is not present in that version.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available for this vulnerability.