CVE-2025-32907
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A flaw was found in the libsoup library in the implementation of HTTP range requests. It allows a malicious client to request the same range multiple times in a single HTTP request, causing excessive memory consumption on the server. This vulnerability does not enable a full denial of service.
Risk Assessment
The risk involves potential server overload by sending a crafted HTTP request, which may lead to memory exhaustion and performance degradation in applications using libsoup.
Recommendation
It is recommended to update the libsoup library to the latest patched version and to limit the number of allowed ranges in HTTP requests at the server level.
Original NVD description (English source)
A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service.