The libsoup library used in GNOME for HTTP client and server functionality contains multiple vulnerabilities: CVE-2025-32906 involves out-of-bounds reads in soup_headers_parse_request(); CVE-2025-32911 is a double free vulnerability in soup_message_headers_get_content_disposition() related to GHashTable values; CVE-2025-32913 is a NULL pointer dereference in the same function when a 'filename' parameter is present but empty; CVE-2025-46421 concerns information disclosure where the libsoup client may send Authorization headers to unintended hosts during redirects; and CVE-2025-46420 is a memory leak in soup_header_parse_quality_list(). Red Hat has released updated libsoup packages for Red Hat Enterprise Linux 8.2 to address these issues as detailed in advisory RHSA-2025:4538.

These vulnerabilities can lead to memory corruption issues such as out-of-bounds reads, double frees, and NULL pointer dereferences, potentially causing application crashes or undefined behavior. The information disclosure vulnerability may allow sensitive Authorization headers to be sent to unintended hosts during HTTP redirects, risking credential leakage. The memory leak could degrade application performance over time. Collectively, these issues pose a significant risk to applications relying on libsoup for HTTP communications.

Red Hat has released updated libsoup packages for Red Hat Enterprise Linux 8.2 that address these vulnerabilities. Users should apply these official patches as described in Red Hat advisory RHSA-2025:4538 and the referenced update article (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated beyond applying the vendor-provided updates.