CVE-2025-46420

What it actually does

Memory leak in soup_header_parse_quality_list when parsing quality lists containing elements with all zeroes, leading to unbounded memory consumption and eventual denial of service.

Why it matters to the business

Applications may exhaust memory under normal or attacker-controlled traffic, causing service outages or degraded performance until restarted; the issue affects widely used networking components with high ecosystem prevalence.

How an attack unfolds

An attacker crafts HTTP requests or responses containing specially formatted Accept or similar headers whose quality list consists solely of zero-valued elements, repeatedly triggering the leaky parser path until memory pressure forces the process to crash or become unresponsive.

How to fix it

Upgrade github.com/apple/swift-asn1 (SwiftURL) to version 1.3.1 or later; rebuild and redeploy all dependent applications after the upgrade.

How to confirm the fix worked

Confirm the installed version of the affected package is at least 1.3.1; monitor memory usage under synthetic loads that include zero-valued quality lists to verify the leak is closed.

Typical attack path

1. Identify a reachable endpoint that processes HTTP headers through the vulnerable parsing function
2. Craft a request containing an Accept (or equivalent) header whose quality list contains only all-zero entries
3. Send the request repeatedly or at volume to amplify memory consumption
4. Observe service degradation or crash once memory limits are reached

How to detect it

Search application and system logs for repeated parsing of Accept or similar headers containing only zero quality values; correlate with memory-usage telemetry showing steady growth without corresponding traffic increases.

What your security team should do

• Prioritize upgrade to the fixed version within standard change windows given the DoS impact and public disclosure
• Add the vulnerable package to dependency scanning policies to block future regressions
• Review logging and monitoring for sudden memory spikes on services handling HTTP traffic