CVE-2025-32049

What it actually does

SoupWebsocketConnection accepts an oversized WebSocket message, triggering unbounded memory allocation that exhausts resources and produces a denial of service.

Why it matters to the business

MariaDB Galera clusters on Red Hat OpenStack 10 can become unavailable after a single unauthenticated network request, disrupting database replication and dependent OpenStack services; the flaw has been public for 573 days with slowly rising exploitability probability.

How an attack unfolds

An attacker locates an exposed libsoup-based WebSocket endpoint in an affected mariadb-galera deployment, crafts a single large message, and transmits it over an unauthenticated connection; the server allocates memory for the message and either crashes or becomes unresponsive.

How to fix it

Upgrade mariadb-galera, mariadb-galera-common, mariadb-galera-debuginfo, and mariadb-galera-server packages on Red Hat OpenStack 10 to version 1:5.5.62-2.el7ost or later; restart affected services and verify the new package versions are running.

How to confirm the fix worked

Query installed package versions with rpm or dnf to confirm 1:5.5.62-2.el7ost or newer; perform a controlled WebSocket test sending a large message and monitor memory usage to ensure allocation limits are enforced.

Typical attack path

1. Scan for reachable mariadb-galera or OpenStack endpoints that expose WebSocket listeners
2. Establish an unauthenticated WebSocket connection to SoupWebsocketConnection
3. Transmit a single oversized message payload
4. Observe resource exhaustion leading to service denial

How to detect it

Review web server and application logs for unusually large incoming WebSocket frames, correlate with sudden memory spikes or OOM killer events on mariadb-galera hosts, and inspect process accounting for repeated connection attempts from the same sources.

What your security team should do

• Immediately schedule the listed package upgrades on all Red Hat OpenStack 10 mariadb-galera nodes
• Add network ACLs or WAF rules to restrict unauthenticated WebSocket traffic to the affected services until patches are applied
• Monitor EPSS trend and threat intelligence feeds for any increase in observed exploitation attempts