CVE-2024-52531

What it actually does

Buffer overflow in soup_header_parse_param_list_strict when performing UTF-8 conversion on header parameters; network-supplied input cannot trigger the flaw.

Why it matters to the business

Applications using affected libsoup versions may crash or experience memory corruption under specific local parsing conditions, potentially leading to denial of service or limited code execution in constrained environments.

How an attack unfolds

An attacker supplies specially crafted header data that reaches the strict parameter parsing path and triggers UTF-8 conversion; because network input cannot reach this code path, exploitation requires local or application-specific input sources rather than remote HTTP requests.

How to fix it

Update gnome/libsoup to a build containing commit 7339df2be0dfc2ae143edc15042dadd9a008e7eb (equivalent to version 3.6.1 or later). Rebuild and redeploy any dependent applications after the update.

How to confirm the fix worked

Confirm the installed libsoup version is 3.6.1 or newer, or verify the presence of commit 7339df2be0dfc2ae143edc15042dadd9a008e7eb in the source tree; test header parsing functions with known-bad UTF-8 parameter inputs.

Typical attack path

1. Identify an application that calls soup_header_parse_param_list_strict with attacker-controlled data
2. Craft input that forces UTF-8 conversion on malformed parameters
3. Trigger the buffer overflow to corrupt memory or cause a crash

How to detect it

Search application logs and crash reports for segmentation faults or memory errors occurring inside libsoup header-parsing functions; review process coredumps that reference soup_header_parse_param_list_strict.

What your security team should do

• Prioritize upgrade of libsoup in all builds and containers within the next patching cycle
• Review applications that directly invoke soup_header_parse_param_list_strict for additional input sanitization
• Monitor for any downstream packages that bundle the vulnerable libsoup version