Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.0

libsoup2.4 can let malicious web client corrupt memory

CVE-2025-32911 · published 1 year ago
Summary

The libsoup2.4 library used in Debian systems can be tricked by a crafted web request to overwrite its own memory, which could cause the program to crash or behave unpredictably. This affects the standard libsoup2.4 package and the rootio‑libsoup2.4 variant. Apply the latest security updates for these packages to protect your servers.

What to do
  • Update debian libsoup2.4 to version 2.74.3-1+deb12u1.aikido.3.
  • Update debian rootio-libsoup2.4 to version 2.74.3-1+deb12u1.aikido.3.
  • Update debian libsoup2.4 to version 2.74.3-1+deb12u1.aikido.1.
  • Update debian rootio-libsoup2.4 to version 2.74.3-1+deb12u1.aikido.1.
  • Update libsoup2.4 to version 2.74.3-1+deb12u1.aikido.5.
  • Update rootio-libsoup2.4 to version 2.74.3-1+deb12u1.aikido.5.
Affected software
Ecosystem VendorProductAffected versions
Root:Debian:12 debian libsoup2.4 < 2.74.3-1+deb12u1.aikido.3
< 2.74.3-1+deb12u1.aikido.1
Fix: upgrade to 2.74.3-1+deb12u1.aikido.3
Root:Debian:12 debian rootio-libsoup2.4 < 2.74.3-1+deb12u1.aikido.3
< 2.74.3-1+deb12u1.aikido.1
Fix: upgrade to 2.74.3-1+deb12u1.aikido.3
Root:Debian:12 – libsoup2.4 < 2.74.3-1+deb12u1.aikido.5
Fix: upgrade to 2.74.3-1+deb12u1.aikido.5
Root:Debian:12 – rootio-libsoup2.4 < 2.74.3-1+deb12u1.aikido.5
Fix: upgrade to 2.74.3-1+deb12u1.aikido.5
Original advisory text
CVE-2025-32911 in libsoup2.4 - Patched by Root
A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-590Free of Memory not on the Heap
Timeline
Published15 Apr 2025
Updated7 Oct 2026
First seen7 Mar 2026
Sources
CVE-2025-32911 · NVD
ROOT-OS-DEBIAN-12-CVE-2025-32911 · OSV
Track software like this
Free during beta