CVE-2025-32912

A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash.

A NULL pointer dereference flaw of moderate severity was found in libsoup's SoupAuthDigest HTTP Digest authentication handling, affecting libsoup as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. When a libsoup-based client uses Digest authentication and receives an Unauthorized response in which a malicious or compromised HTTP server omits the required "nonce" parameter, the client crashes. This is a client-side denial of service only; confidentiality and integrity are not affected, and exploitation requires the user to connect to an attacker-controlled server. Red Hat's severity rating (MODERATE, CVSS 6.5) matches the upstream assessment. The fix has been deferred for libsoup in Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat In-Vehicle OS 1, where the residual risk is limited to a crash of the affected client application when it connects to a malicious server; a fix is being pursued for libsoup3 in Red Hat Enterprise Linux 10 and for libsoup in Fedora through the community process. The legacy libsoup component in Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support is out of support scope, and the mingw-libsoup component in Red Hat Build of RHEL 8 will not be fixed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Currently, no mitigation is available for this vulnerability.