CVE-2025-32910

What it actually does

NULL pointer dereference in soup_auth_digest_authenticate() that causes the libsoup client to crash on receipt of a crafted digest authentication challenge.

Why it matters to the business

Denial-of-service against any application or service that uses the vulnerable library to perform HTTP requests, leading to application downtime and potential service disruption; no data loss or remote code execution is expected.

How an attack unfolds

An attacker positions themselves as a malicious HTTP server or MITM and returns a specially crafted WWW-Authenticate header containing a digest challenge that triggers the NULL dereference inside soup_auth_digest_authenticate when the client attempts authentication.

How to fix it

Upgrade gstreamer1-plugins-good and related packages on Red Hat Enterprise Linux 8.8 EUS to version 0:1.16.1-4.el8_8 or later; rebuild and redeploy any containers or images that embed the vulnerable packages.

How to confirm the fix worked

Verify installed package versions match or exceed the fixed releases; run regression tests that exercise HTTP digest authentication paths; monitor application stability under crafted authentication responses.

Typical attack path

1. Attacker intercepts or controls the HTTP response path to the victim client
2. Victim application initiates an HTTP request that triggers digest authentication
3. Attacker supplies a malicious WWW-Authenticate digest header
4. soup_auth_digest_authenticate is called and dereferences a NULL pointer
5. Client process crashes, causing application outage

How to detect it

Search application and system logs for abrupt process termination or segmentation faults immediately after HTTP requests that involve digest authentication; correlate with external HTTP responses containing WWW-Authenticate headers.

What your security team should do

• Apply the listed package updates immediately on all Red Hat EUS 8.8 systems
• Scan container images and rebuild pipelines for the affected gstreamer packages
• Add the fixed versions to internal approved package lists and SBOMs
• Review logs for unexpected client crashes during HTTP authentication as a temporary detection measure