Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux libsoup can hang or be misled by web traffic
published 1 year ago
Summary
The libsoup library used in AlmaLinux for web client and server functions can get stuck in an endless loop when processing certain WebSocket data, and it can be tricked into handling malformed HTTP requests that contain hidden null characters. This could cause service interruptions or allow attackers to bypass normal request handling. Apply the latest security update for libsoup and its development package as soon as possible.
What to do
- Update almalinux libsoup to version 2.62.3-6.el8_10.
- Update almalinux libsoup-devel to version 2.62.3-6.el8_10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | libsoup |
< 2.62.3-6.el8_10 Fix: upgrade to 2.62.3-6.el8_10
|
| AlmaLinux:8 | almalinux | libsoup-devel |
< 2.62.3-6.el8_10 Fix: upgrade to 2.62.3-6.el8_10
|
Original advisory text
Important: libsoup security update
The libsoup packages provide an HTTP client and server library for GNOME.
Security Fix(es):
* libsoup: infinite loop while reading websocket data (CVE-2024-52532)
* libsoup: HTTP request smuggling via stripping null bytes from the ends of header names (CVE-2024-52530)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* libsoup: infinite loop while reading websocket data (CVE-2024-52532)
* libsoup: HTTP request smuggling via stripping null bytes from the ends of header names (CVE-2024-52530)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2024:9573 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2024-52530 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2024-52532 Third Party Advisory
- https://bugzilla.redhat.com/2325276 Third Party Advisory
- https://bugzilla.redhat.com/2325284 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2024-9573.html Vendor Advisory
Timeline
Published13 Nov 2024
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2024:9573 · OSV
Track software like this
Free during beta