The vulnerability CVE-2025-12105 affects the libsoup HTTP library used in GNOME and WebKit-based applications. It arises from improper synchronization in the asynchronous message queue handling during HTTP/2 read completion, leading to a use-after-free condition when network operations are aborted at certain timings. This can be triggered remotely by attackers through specific HTTP/2 read and cancel sequences, resulting in application crashes (denial of service). Red Hat has issued security advisories and released patched libsoup3 packages (version 3.6.5-3.el10_0.10 and 3.6.5-3.el10_1.7) for Red Hat Enterprise Linux 10 and its Extended Update Support variants to fix this issue.

The vulnerability allows remote attackers to cause a denial-of-service condition by crashing applications that use the vulnerable libsoup library for HTTP/2 communications. There is no indication of confidentiality or integrity impact. The CVSS v3.1 base score is 7.5 (High), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

A security update fixing this use-after-free vulnerability is available from Red Hat for libsoup3 packages in Red Hat Enterprise Linux 10 and Extended Update Support releases. Users should apply the updated packages (e.g., libsoup3-3.6.5-3.el10_0.10 and libsoup3-3.6.5-3.el10_1.7) as provided in the Red Hat advisories RHSA-2025:23139 and RHSA-2025:23437. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258. No additional mitigation is required beyond applying the official patches.