CVE-2025-4476
Medium · 4.3CVSS
4.3
EPSS
0.4%
Published
May 16, 2025
CISA due date
—
Cloudanix analysis
A bug in a widely used web communication library lets attackers crash programs simply by sending a specially formatted reply when the program tries to connect to a fake website.
- Exploitation
- Requires User Interaction
- Attacker needs
- User Interaction
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- Library
- Class
- Denial of service
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
A libsoup HTTP client crashes when processing a 401 response containing a malformed domain parameter in the WWW-Authenticate header.
Why it matters to the business
Client applications using the affected library on Ubuntu systems can be remotely terminated, causing service outages; the issue affects many kernel packages with moderate ecosystem prevalence and low exploitation likelihood.
How an attack unfolds
An attacker hosts a malicious HTTP server that returns a specially crafted 401 response; the victim application using libsoup is tricked into connecting, triggering the crash on header processing.
How to fix it
Upgrade affected packages to the listed fixed versions including linux-azure-6.11 to 6.11.0-1012.12~24.04.1, linux-gcp-6.11 to 6.11.0-1011.11~24.04.1, linux-riscv to 6.8.0-53.55.1, and equivalent updates for linux-azure-6.8, linux-gcp-6.8, linux-hwe-6.8, linux-ibm-6.8, linux-lowlatency-hwe-6.8, linux-nvidia-6.8, linux-oracle-6.8, linux-riscv-6.8, and linux-realtime-6.8 packages.
How to confirm the fix worked
Verify installed package versions match or exceed the fixed releases and confirm absence of the vulnerable libsoup code path through dependency checks or application restarts without crashes on test headers.
Typical attack path
- Deploy a malicious HTTP server returning crafted 401 responses
- Embed malformed domain parameter in WWW-Authenticate header
- Induce the target client application to connect to the attacker server
- Trigger application crash via header parsing
How to detect it
Inspect application crash logs and core dumps for libsoup-related failures during HTTP 401 handling; review network logs for unexpected connections to untrusted servers returning authentication challenges.
What your security team should do
- Apply the listed package updates to all affected Ubuntu systems immediately
- Restrict outbound connections from client applications to trusted endpoints only
- Monitor application logs for unexpected crashes during HTTP authentication flows
- Review and harden any code paths that process untrusted HTTP responses
The record
A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client application into connecting to the attacker's malicious server.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | libsoup2.4 | 0 | No fix |
| Debian:12 | libsoup2.4 | 0 | No fix |
| Debian:12 | libsoup3 | 0 | No fix |
| Debian:13 | libsoup2.4 | 0 | No fix |
| Debian:13 | libsoup3 | 0 | No fix |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | libsoup | 0 | 3.0.4-150400.3.10.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | libsoup | 0 | 3.0.4-150400.3.10.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | libsoup | 0 | 3.0.4-150400.3.10.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | libsoup | 0 | 3.0.4-150400.3.10.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | libsoup | 0 | 3.4.4-150600.3.10.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libsoup | 0 | 3.4.4-150600.3.10.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libsoup2 | 0 | 2.74.3-150600.4.24.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | libsoup | 0 | 3.0.4-150400.3.10.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | libsoup | 0 | 3.0.4-150400.3.10.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | libsoup2 | 0 | 2.74.3-150600.4.24.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | libsoup | 0 | 3.0.4-150400.3.10.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | libsoup | 0 | 3.0.4-150400.3.10.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | libsoup2 | 0 | 2.74.3-150600.4.24.1 |
| SUSE:Manager Proxy 4.3 | libsoup | 0 | 3.0.4-150400.3.10.1 |
| SUSE:Manager Server 4.3 | libsoup | 0 | 3.0.4-150400.3.10.1 |
| openSUSE:Leap 15.6 | libsoup | 0 | 3.4.4-150600.3.10.1 |
| openSUSE:Leap 15.6 | libsoup2 | 0 | 2.74.3-150600.4.24.1 |
| openSUSE:Leap 16.0 | libsoup2 | 0 | 2.74.3-160000.4.1 |
| openSUSE:Tumbleweed | libsoup | 0 | 3.6.5-5.1 |
| openSUSE:Tumbleweed | libsoup2 | 0 | 2.74.3-15.1 |
Related vulnerabilities
- CVE-2025-9901 A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is… Also affects libsoup2.4
- CVE-2025-4969 A vulnerability was found in the libsoup package. Also affects libsoup2.4
- CVE-2025-4945 A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME… Also affects libsoup2.4
- CVE-2025-4948 A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP… Also affects libsoup2.4
- CVE-2025-4035 A flaw was found in libsoup. Also affects libsoup2.4
- CVE-2025-46421 A flaw was found in libsoup. Also affects libsoup2.4
- CVE-2025-46420 A flaw was found in libsoup. Also affects libsoup2.4
- CVE-2025-32911 A use-after-free type vulnerability was found in libsoup, in the… Also affects libsoup2.4