CVE-2025-4948

Description

A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart messages. Due to improper validation, an internal calculation can go wrong, leading to an integer underflow. This can cause the program to access invalid memory and crash. As a result, any application or server using libsoup could be forced to exit unexpectedly, creating a denial-of-service (DoS) risk.

Reserved 2025-05-19 | Published 2025-05-19 | Updated 2025-06-04 | Assigner redhat

Problem types

Integer Underflow (Wrap or Wraparound)

Product status

Default status
affected

0:3.6.5-3.el10_0.6 before *
unaffected

Default status
affected

0:2.62.3-9.el8_10 before *
unaffected

Default status
affected

0:2.62.3-9.el8_10 before *
unaffected

Default status
affected

0:2.62.3-1.el8_2.5 before *
unaffected

Default status
affected

0:2.62.3-2.el8_6.5 before *
unaffected

Default status
affected

0:2.62.3-2.el8_6.5 before *
unaffected

Default status
affected

0:2.62.3-2.el8_6.5 before *
unaffected

Default status
affected

0:2.62.3-3.el8_8.5 before *
unaffected

Default status
affected

0:2.72.0-10.el9_6.2 before *
unaffected

Default status
affected

0:2.72.0-8.el9_0.5 before *
unaffected

Default status
affected

0:2.72.0-8.el9_2.5 before *
unaffected

Default status
affected

0:2.72.0-8.el9_4.5 before *
unaffected

Default status
unknown

Default status
affected

Timeline

2025-05-19:	Reported to Red Hat.
2025-05-19:	Made public.

Credits

Red Hat would like to thank fouzhe and zkbytes for reporting this issue.

References

access.redhat.com/errata/RHSA-2025:8126 (RHSA-2025:8126) vendor-advisory

access.redhat.com/errata/RHSA-2025:8128 (RHSA-2025:8128) vendor-advisory

access.redhat.com/errata/RHSA-2025:8132 (RHSA-2025:8132) vendor-advisory

access.redhat.com/errata/RHSA-2025:8139 (RHSA-2025:8139) vendor-advisory

access.redhat.com/errata/RHSA-2025:8140 (RHSA-2025:8140) vendor-advisory

access.redhat.com/errata/RHSA-2025:8252 (RHSA-2025:8252) vendor-advisory

access.redhat.com/errata/RHSA-2025:8480 (RHSA-2025:8480) vendor-advisory

access.redhat.com/errata/RHSA-2025:8481 (RHSA-2025:8481) vendor-advisory

access.redhat.com/errata/RHSA-2025:8482 (RHSA-2025:8482) vendor-advisory

access.redhat.com/security/cve/CVE-2025-4948 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2367183 (RHBZ#2367183) issue-tracking

cve.org (CVE-2025-4948)

nvd.nist.gov (CVE-2025-4948)

Download JSON