The libsoup library for GNOME, used as an HTTP client and server library, contains multiple security vulnerabilities. These include: out-of-bounds reads in soup_headers_parse_request() (CVE-2025-32906), double free in soup_message_headers_get_content_disposition() via a GHashTable value (CVE-2025-32911), NULL pointer dereference in soup_message_headers_get_content_disposition when a filename parameter is present but empty (CVE-2025-32913), information disclosure due to libsoup client sending Authorization headers to a different host upon redirection (CVE-2025-46421), and a memory leak in soup_header_parse_quality_list() (CVE-2025-46420). Red Hat has released updated libsoup packages for Red Hat Enterprise Linux 8.6 variants to address these issues as detailed in advisory RHSA-2025:4624.

The identified vulnerabilities can lead to memory corruption issues such as out-of-bounds reads, double free, and NULL pointer dereference, which may cause application crashes or potentially enable further exploitation. The information disclosure vulnerability could cause sensitive Authorization headers to be sent to unintended hosts during HTTP redirects, risking credential leakage. The memory leak may degrade application performance over time. These issues collectively pose a high security risk to systems using affected libsoup versions.

Red Hat has released updated libsoup packages that fix these vulnerabilities. Users of Red Hat Enterprise Linux 8.6 variants should apply the security update RHSA-2025:4624 promptly to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official patches.