CVE-2025-4476

A use-after-free vulnerability was found in the libsoup library, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.

A flaw was found in libsoup where sending an HTTP/2 request body from a non-pollable input stream can lead to buffering more data than the flow-control window allows. A malicious server can shrink SETTINGS_INITIAL_WINDOW_SIZE while the buffered read is in progress, causing the client to copy the full buffer into a smaller DATA callback without bounds check, potentially aborting the process or failing the HTTP/2 session.

A use-after-free vulnerability was found in libsoup's HTTP/2 client implementation. A malicious HTTP/2 server or MITM attacker can exploit it when a GNOME application uploads a file over HTTP/2 and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, information disclosure, or arbitrary code execution.

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. The coalescing loop uses O(N²) operations when many identical ranges are supplied, allowing CPU exhaustion. The issue is reachable server-side without authentication and can block the event loop for ~90 ms per request at the wire maximum.

In libsoup, in SoupServer's HTTP Range header processing, the sort_ranges() comparator truncates a 64-bit subtraction result to 32-bit int, causing incorrect sorting for ranges on files larger than ~2 GB. This leads to omission of requested ranges in HTTP 206 Partial Content responses.

In libsoup, after establishing a CONNECT tunnel through an HTTP proxy, the Proxy-Authorization header is incorrectly attached to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials.

In libsoup, the chunked transfer encoding parser uses a permissive parsing function that accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.

In libsoup, an unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can send a crafted response, causing the client application to crash or disclose sensitive heap memory.

A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.

An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The soup_multipart_input_stream_read_headers() function does not properly restrict the size of boundary strings, leading to a read past the allocated buffer. A remote unauthenticated attacker can exploit this to cause a denial of service (DoS) or potentially read unauthorized memory fragments.