CVE-2025-32907

libsoup: Denial of service in server when client requests a large amount of overlapping ranges with Range header

Loading…

Severity

Moderate

Red Hat Product Security

5.3

CVSS 3.1

Review impact separately from score.

Published · April 14, 2025

Updated · June 30, 2026

Description

A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Currently, no mitigation was found for this vulnerability.

CVSS / CWE

CVSS 3.1 · 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-1050 · Excessive Platform Resource Consumption within a Loop