Red Hat alert RHSA-2025:8128-01 (libsoup3)

An update for libsoup3 is now available for Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

Libsoup is an HTTP library implementation in C. It was originally part of a
SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP
and non-SOAP parts have now been split into separate packages.  libsoup uses
the Glib main loop and is designed to work well with GTK applications. This
enables GNOME applications to access HTTP servers on the network in a
completely asynchronous fashion, very similar to the Gtk+ programming model
(a synchronous operation mode is also supported for those who want it), but
the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Denial of Service attack to websocket server (CVE-2025-32049)

* libsoup: Denial of service in server when client requests a large amount of
overlapping ranges with Range header (CVE-2025-32907)

* libsoup: Cookie domain validation bypass via uppercase characters in
libsoup (CVE-2025-4035)

* libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to
Denial of Service in libsoup (CVE-2025-4948)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0
International License (https://creativecommons.org/licenses/by/4.0/). If you
distribute this content, or a modified version of it, you must provide
attribution to Red Hat Inc. and provide a link to the original.

Original: https://access.redhat.com/security/data/csaf/v2/advisories/2025/rhsa-2025_8128.json