CVE-2025-2784High· 7.0▾ TwilightA flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38.5 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
0.7% → 0.8%
A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.
libsoup < 3.6.5codeready_linux_builder = 10.0codeready_linux_builder_for_arm64 = 10.0_aarch64codeready_linux_builder_for_arm64_eus = 10.0_aarch64codeready_linux_builder_for_ibm_z_systems = 10.0_s390xcodeready_linux_builder_for_ibm_z_systems_eus = 10.0_s390xcodeready_linux_builder_for_power_little_endian = 10.0_ppc64lecodeready_linux_builder_for_power_little_endian_eus = 10.0_ppc64leenterprise_linux = 8.0enterprise_linux = 9.0enterprise_linux = 10.0enterprise_linux_eus = 8.8enterprise_linux_eus = 9.2enterprise_linux_eus = 9.4enterprise_linux_eus = 9.6enterprise_linux_eus = 10.0enterprise_linux_for_arm_64 = 8.0_aarch64enterprise_linux_for_arm_64 = 9.0_aarch64enterprise_linux_for_arm_64 = 10.0_aarch64enterprise_linux_for_arm_64_eus = 8.8_aarch64enterprise_linux_for_arm_64_eus = 9.2_aarch64enterprise_linux_for_arm_64_eus = 9.4_aarch64enterprise_linux_for_arm_64_eus = 9.6_aarch64enterprise_linux_for_arm_64_eus = 10.0_aarch64enterprise_linux_for_ibm_z_systems = 8.0_s390xenterprise_linux_for_ibm_z_systems = 9.0_s390xenterprise_linux_for_ibm_z_systems = 10.0_s390xenterprise_linux_for_ibm_z_systems_eus = 8.8_s390xenterprise_linux_for_ibm_z_systems_eus = 9.2_s390xenterprise_linux_for_ibm_z_systems_eus = 9.4_s390xenterprise_linux_for_ibm_z_systems_eus = 9.6_s390xenterprise_linux_for_ibm_z_systems_eus = 10.0_s390xenterprise_linux_for_power_little_endian = 8.0_ppc64leenterprise_linux_for_power_little_endian = 9.0_ppc64leenterprise_linux_for_power_little_endian = 10.0_ppc64leenterprise_linux_for_power_little_endian_eus = 8.8_ppc64leenterprise_linux_for_power_little_endian_eus = 9.2_ppc64leenterprise_linux_for_power_little_endian_eus = 9.4_ppc64leenterprise_linux_for_power_little_endian_eus = 9.6_ppc64leenterprise_linux_for_power_little_endian_eus = 10.0_ppc64leenterprise_linux_server = 7.0enterprise_linux_server_aus = 8.2enterprise_linux_server_aus = 8.4enterprise_linux_server_aus = 8.6enterprise_linux_server_aus = 9.2enterprise_linux_server_aus = 9.4enterprise_linux_server_aus = 9.6enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 8.6_ppc64leenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.0_ppc64leenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.6_ppc64leenterprise_linux_server_tus = 8.6enterprise_linux_server_tus = 8.8enterprise_linux_update_services_for_sap_solutions = 8.8enterprise_linux_update_services_for_sap_solutions = 9.0enterprise_linux_update_services_for_sap_solutions = 9.2enterprise_linux_update_services_for_sap_solutions = 9.4enterprise_linux_update_services_for_sap_solutions = 9.6Upgrade past the affected range:
libsoup 3.6.5Connected by shared product, vendor, weakness, or advisory.
CVE-2025-32914High· 7.4A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read
CVE-2025-32906High· 7.5A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read
CVE-2025-32910Medium· 6.5A flaw was found in libsoup, where soup_auth_digest_authenticate() is vulnerable to a NULL pointer dereference
CVE-2025-32909Medium· 5.3A flaw was found in libsoup
CVE-2026-58011Medium· 6.5A flaw was found in GLib
CVE-2021-3506High· 7.1An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4