CVE-2025-32907

What it actually does

The flaw permits a client to issue a single HTTP request containing many duplicate range specifications, causing the server to allocate substantial memory buffers for each repeated range without releasing them promptly.

Why it matters to the business

Service performance degrades under sustained attack, leading to higher resource consumption and potential need for scaled infrastructure or emergency restarts in affected web-facing applications.

How an attack unfolds

An attacker crafts an HTTP request embedding repeated identical range headers targeting the vulnerable range-request handling logic; the server processes each duplicate range independently, exhausting memory until the process becomes unstable or slow.

How to fix it

Upgrade affected pam packages on Red Hat Enterprise Linux 9 to version 0:1.5.1-21.el9_5 or later in both AppStream and BaseOS repositories; apply the update via standard package management and restart any services using the library.

How to confirm the fix worked

Confirm package versions match the fixed releases using rpm -q, review changelogs for range-request fixes, and test with a crafted multi-range request to verify memory usage remains bounded.

Typical attack path

1. Identify an HTTP endpoint served by the vulnerable component
2. Craft a single request containing many identical Range headers
3. Transmit the request repeatedly from one or more clients
4. Observe progressive memory growth on the target server

How to detect it

Review web server access logs for requests containing unusually high numbers of identical Range header values; correlate with process memory growth in system monitoring; no ransomware or KEV exploitation reported.

What your security team should do

• Prioritize patching within normal maintenance windows given moderate severity and low EPSS
• Monitor memory usage metrics on web servers exposing HTTP range functionality
• Apply network-level rate limiting on range header volume as a temporary control