CVE-2025-32911

What it actually does

A use-after-free in soup_message_headers_get_content_disposition allows a remote HTTP client to trigger memory corruption inside the libsoup server process.

Why it matters to the business

Compromise or crash of HTTP servers on Red Hat Enterprise Linux 9.2 EUS systems could lead to service outages or unauthorized access; 561 days have passed since publication with a minor EPSS uptick and no KEV listing, indicating moderate ongoing exposure across many kernel packages.

How an attack unfolds

An attacker sends a crafted HTTP request containing a malicious Content-Disposition header that triggers the use-after-free during header parsing; memory corruption is then leveraged for code execution or denial of service. Threat actor references include FreeType Out-of-Bounds Write Vulnerability campaigns.

How to fix it

Upgrade all listed packages on Red Hat Enterprise Linux 9.2 EUS to the exact fixed versions, for example kernel to 0:5.14.0-284.97.1.el9_2 and bpftool to 0:7.0.0-284.97.1.el9_2; apply updates via standard package management and reboot as required.

How to confirm the fix worked

Confirm installed package versions match or exceed the listed fixed releases using rpm -q or dnf; re-test affected HTTP endpoints with header fuzzing tools to verify absence of the crash condition.

Typical attack path

1. Craft and send a malicious HTTP request targeting soup_message_headers_get_content_disposition
2. Trigger use-after-free condition via specially formatted Content-Disposition header
3. Exploit resulting memory corruption to achieve code execution or crash the server

How to detect it

Review web server and application logs for malformed or unusually large Content-Disposition headers; inspect process memory dumps or crash reports for signs of corruption in libsoup header handling after the 2025-04-15 publication date.

What your security team should do

• Apply the kernel and bpftool updates to the specified fixed versions immediately on all RHEL 9.2 EUS systems
• Scan the environment for the listed affected packages and prioritize hosts reachable from untrusted networks
• Monitor EPSS trend and threat actor activity for any increase in exploitation likelihood