CVE-2025-32913

What it actually does

NULL pointer dereference in soup_message_headers_get_content_disposition() triggered by crafted HTTP content-disposition headers, causing immediate process crash.

Why it matters to the business

Remote attackers can repeatedly crash any application or service using libsoup for HTTP handling, resulting in denial of service, service outages, and potential loss of availability for dependent systems.

How an attack unfolds

An attacker sends a specially crafted HTTP request or response containing a malformed Content-Disposition header to a libsoup-based client or server. When the application calls soup_message_headers_get_content_disposition(), the function dereferences a NULL pointer and terminates the process.

How to fix it

Upgrade all affected Red Hat Enterprise Linux 8.6 AUS packages to the versions containing the fix: bpftool, kernel, kernel-core, kernel-devel, kernel-headers, kernel-modules, kernel-tools, perf, python3-perf and related debug packages to 0:4.18.0-372.133.1.el8_6 or later. Reboot systems after kernel updates and restart any services using libsoup.

How to confirm the fix worked

Verify installed package versions match or exceed the fixed releases listed above. Monitor process stability under simulated malicious HTTP traffic containing varied Content-Disposition headers. Confirm absence of segmentation faults in logs after applying updates.

Typical attack path

1. Identify a target application or service that links against libsoup and processes untrusted HTTP messages.
2. Craft an HTTP message with a Content-Disposition header designed to trigger the NULL dereference path.
3. Send the malicious message to the target over the network.
4. Observe immediate crash of the libsoup process, confirming denial of service.

How to detect it

Review application and system logs for segmentation faults or crashes in processes linked to libsoup immediately after receiving HTTP requests. Correlate crash timestamps with incoming HTTP traffic containing Content-Disposition headers. Examine core dumps for references to soup_message_headers_get_content_disposition if available.

What your security team should do

• Prioritize patching all listed kernel and related packages on Red Hat Enterprise Linux 8.6 AUS systems to the 4.18.0-372.133.1.el8_6 release.
• Inventory applications and services that depend on libsoup and schedule restarts or redeployments after the update.
• Implement network-level filtering or WAF rules to drop or sanitize suspicious Content-Disposition headers until patches are applied.
• Enable process crash reporting and monitoring to detect any remaining instances of the flaw.