Interpretation Conflict in libsoup - CVE-2025-32908

Vulnerability identifier: #VU109833

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-32908

CWE-ID: CWE-436

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

libsoup
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Basesystem Module
openSUSE Leap
Ubuntu
Anolis OS
Fedora
IBM Observability with Instana
libsoup2.4 (Ubuntu package)
libsoup-debugsource
libsoup-lang
libsoup-3_0-0
libsoup-3_0-0-debuginfo
libsoup-devel
typelib-1_0-Soup-3_0
libsoup-3_0-0-32bit
libsoup-devel-32bit
libsoup-3_0-0-32bit-debuginfo
libsoup-3_0-0-64bit
libsoup-devel-64bit
libsoup-3_0-0-64bit-debuginfo
libsoup3
libsoup3-devel
libsoup3-doc

Install updates from vendor's website.

IBM Observability with Instana - update to 1.0.295
libsoup2.4 (Ubuntu package) - addressed in versions 2.52.2-1ubuntu0.3+esm3, 2.62.1-1ubuntu0.4+esm4, 2.70.0-1ubuntu0.5, 2.74.2-3ubuntu0.5, 2.74.3-6ubuntu1.5, 2.74.3-7ubuntu0.5, 2.74.3-10ubuntu0.3, 3.0.7-0ubuntu1+esm4, 3.4.4-5ubuntu0.4, 3.6.0-2ubuntu0.4, 3.6.5-1ubuntu0.1
libsoup-debugsource - update to 3.4.4-150600.3.7.1
libsoup-lang - update to 3.4.4-150600.3.7.1
libsoup-3_0-0 - update to 3.4.4-150600.3.7.1
libsoup-3_0-0-debuginfo - update to 3.4.4-150600.3.7.1
libsoup-devel - update to 3.4.4-150600.3.7.1
typelib-1_0-Soup-3_0 - update to 3.4.4-150600.3.7.1
libsoup-3_0-0-32bit - update to 3.4.4-150600.3.7.1
libsoup-devel-32bit - update to 3.4.4-150600.3.7.1
libsoup-3_0-0-32bit-debuginfo - update to 3.4.4-150600.3.7.1
libsoup-3_0-0-64bit - update to 3.4.4-150600.3.7.1
libsoup-devel-64bit - update to 3.4.4-150600.3.7.1
libsoup-3_0-0-64bit-debuginfo - update to 3.4.4-150600.3.7.1
libsoup3 - addressed in versions 3.6.5-1, 3.6.5-9
libsoup3-devel - addressed in versions 3.6.5-1, 3.6.5-9
libsoup3-doc - addressed in versions 3.6.5-1, 3.6.5-9
libsoup3 - addressed in versions 3.6.5-2.fc41, 3.6.5-2.fc42

• https://access.redhat.com/errata/RHSA-2025:7505
• https://access.redhat.com/security/cve/CVE-2025-32908
• https://bugzilla.redhat.com/show_bug.cgi?id=2359343

• Interpretation Conflict in libsoup
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• SUSE update for libsoup
• SUSE update for libsoup
• Ubuntu update for libsoup2.4
• Anolis OS update for libsoup3
• Fedora 42 update for libsoup3
• Fedora 41 update for libsoup3
• Anolis OS update for libsoup3