--- id: CVE-2025-2784 title: A flaw was found in libsoup summary: >- A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by… severity: high cvss: 7 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H' cwe: - CWE-125 vendor: gnome product: libsoup affected: - libsoup < 3.6.5 - codeready_linux_builder = 10.0 - codeready_linux_builder_for_arm64 = 10.0_aarch64 - codeready_linux_builder_for_arm64_eus = 10.0_aarch64 - codeready_linux_builder_for_ibm_z_systems = 10.0_s390x - codeready_linux_builder_for_ibm_z_systems_eus = 10.0_s390x - codeready_linux_builder_for_power_little_endian = 10.0_ppc64le - codeready_linux_builder_for_power_little_endian_eus = 10.0_ppc64le - enterprise_linux = 8.0 - enterprise_linux = 9.0 - enterprise_linux = 10.0 - enterprise_linux_eus = 8.8 - enterprise_linux_eus = 9.2 - enterprise_linux_eus = 9.4 - enterprise_linux_eus = 9.6 - enterprise_linux_eus = 10.0 - enterprise_linux_for_arm_64 = 8.0_aarch64 - enterprise_linux_for_arm_64 = 9.0_aarch64 - enterprise_linux_for_arm_64 = 10.0_aarch64 - enterprise_linux_for_arm_64_eus = 8.8_aarch64 - enterprise_linux_for_arm_64_eus = 9.2_aarch64 - enterprise_linux_for_arm_64_eus = 9.4_aarch64 - enterprise_linux_for_arm_64_eus = 9.6_aarch64 - enterprise_linux_for_arm_64_eus = 10.0_aarch64 - enterprise_linux_for_ibm_z_systems = 8.0_s390x - enterprise_linux_for_ibm_z_systems = 9.0_s390x - enterprise_linux_for_ibm_z_systems = 10.0_s390x - enterprise_linux_for_ibm_z_systems_eus = 8.8_s390x - enterprise_linux_for_ibm_z_systems_eus = 9.2_s390x - enterprise_linux_for_ibm_z_systems_eus = 9.4_s390x - enterprise_linux_for_ibm_z_systems_eus = 9.6_s390x - enterprise_linux_for_ibm_z_systems_eus = 10.0_s390x - enterprise_linux_for_power_little_endian = 8.0_ppc64le - enterprise_linux_for_power_little_endian = 9.0_ppc64le - enterprise_linux_for_power_little_endian = 10.0_ppc64le - enterprise_linux_for_power_little_endian_eus = 8.8_ppc64le - enterprise_linux_for_power_little_endian_eus = 9.2_ppc64le - enterprise_linux_for_power_little_endian_eus = 9.4_ppc64le - enterprise_linux_for_power_little_endian_eus = 9.6_ppc64le - enterprise_linux_for_power_little_endian_eus = 10.0_ppc64le - enterprise_linux_server = 7.0 - enterprise_linux_server_aus = 8.2 - enterprise_linux_server_aus = 8.4 - enterprise_linux_server_aus = 8.6 - enterprise_linux_server_aus = 9.2 - enterprise_linux_server_aus = 9.4 - enterprise_linux_server_aus = 9.6 - >- enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 8.6_ppc64le - >- enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.0_ppc64le - >- enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.6_ppc64le - enterprise_linux_server_tus = 8.6 - enterprise_linux_server_tus = 8.8 - enterprise_linux_update_services_for_sap_solutions = 8.8 - enterprise_linux_update_services_for_sap_solutions = 9.0 - enterprise_linux_update_services_for_sap_solutions = 9.2 - enterprise_linux_update_services_for_sap_solutions = 9.4 - enterprise_linux_update_services_for_sap_solutions = 9.6 patched: - libsoup 3.6.5 published: '2025-04-03' updated: '2026-06-25' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-2784' references: - url: 'https://access.redhat.com/errata/RHSA-2025:21657' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:7505' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:8126' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:8132' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:8139' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:8140' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:8252' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:8480' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:8481' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:8482' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:8663' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:9179' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2025-2784' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2354669' label: secalert@redhat.com - url: 'https://gitlab.gnome.org/GNOME/libsoup/-/issues/422' label: secalert@redhat.com - url: 'https://lists.debian.org/debian-lts-announce/2025/04/msg00036.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://gitlab.gnome.org/GNOME/libsoup/-/issues/422' label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 tags: - nvd epss: 0.00844 epssPercentile: 0.5598 ingestedAt: '2026-06-29T13:24:34.188Z' --- ## Overview A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server. ## Affected - `libsoup < 3.6.5` - `codeready_linux_builder = 10.0` - `codeready_linux_builder_for_arm64 = 10.0_aarch64` - `codeready_linux_builder_for_arm64_eus = 10.0_aarch64` - `codeready_linux_builder_for_ibm_z_systems = 10.0_s390x` - `codeready_linux_builder_for_ibm_z_systems_eus = 10.0_s390x` - `codeready_linux_builder_for_power_little_endian = 10.0_ppc64le` - `codeready_linux_builder_for_power_little_endian_eus = 10.0_ppc64le` - `enterprise_linux = 8.0` - `enterprise_linux = 9.0` - `enterprise_linux = 10.0` - `enterprise_linux_eus = 8.8` - `enterprise_linux_eus = 9.2` - `enterprise_linux_eus = 9.4` - `enterprise_linux_eus = 9.6` - `enterprise_linux_eus = 10.0` - `enterprise_linux_for_arm_64 = 8.0_aarch64` - `enterprise_linux_for_arm_64 = 9.0_aarch64` - `enterprise_linux_for_arm_64 = 10.0_aarch64` - `enterprise_linux_for_arm_64_eus = 8.8_aarch64` - `enterprise_linux_for_arm_64_eus = 9.2_aarch64` - `enterprise_linux_for_arm_64_eus = 9.4_aarch64` - `enterprise_linux_for_arm_64_eus = 9.6_aarch64` - `enterprise_linux_for_arm_64_eus = 10.0_aarch64` - `enterprise_linux_for_ibm_z_systems = 8.0_s390x` - `enterprise_linux_for_ibm_z_systems = 9.0_s390x` - `enterprise_linux_for_ibm_z_systems = 10.0_s390x` - `enterprise_linux_for_ibm_z_systems_eus = 8.8_s390x` - `enterprise_linux_for_ibm_z_systems_eus = 9.2_s390x` - `enterprise_linux_for_ibm_z_systems_eus = 9.4_s390x` - `enterprise_linux_for_ibm_z_systems_eus = 9.6_s390x` - `enterprise_linux_for_ibm_z_systems_eus = 10.0_s390x` - `enterprise_linux_for_power_little_endian = 8.0_ppc64le` - `enterprise_linux_for_power_little_endian = 9.0_ppc64le` - `enterprise_linux_for_power_little_endian = 10.0_ppc64le` - `enterprise_linux_for_power_little_endian_eus = 8.8_ppc64le` - `enterprise_linux_for_power_little_endian_eus = 9.2_ppc64le` - `enterprise_linux_for_power_little_endian_eus = 9.4_ppc64le` - `enterprise_linux_for_power_little_endian_eus = 9.6_ppc64le` - `enterprise_linux_for_power_little_endian_eus = 10.0_ppc64le` - `enterprise_linux_server = 7.0` - `enterprise_linux_server_aus = 8.2` - `enterprise_linux_server_aus = 8.4` - `enterprise_linux_server_aus = 8.6` - `enterprise_linux_server_aus = 9.2` - `enterprise_linux_server_aus = 9.4` - `enterprise_linux_server_aus = 9.6` - `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 8.6_ppc64le` - `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.0_ppc64le` - `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.6_ppc64le` - `enterprise_linux_server_tus = 8.6` - `enterprise_linux_server_tus = 8.8` - `enterprise_linux_update_services_for_sap_solutions = 8.8` - `enterprise_linux_update_services_for_sap_solutions = 9.0` - `enterprise_linux_update_services_for_sap_solutions = 9.2` - `enterprise_linux_update_services_for_sap_solutions = 9.4` - `enterprise_linux_update_services_for_sap_solutions = 9.6` ## Remediation Upgrade past the affected range: - `libsoup 3.6.5`