The libsoup library used in GNOME for HTTP client and server functionality contains multiple security flaws. These include an integer overflow in append_param_quoted (CVE-2025-32050), heap buffer overflows in sniff_unknown(), sniff_feed_or_html(), and skip_insignificant_space() (CVE-2025-32052, CVE-2025-32053), out-of-bounds reads in soup_headers_parse_request() (CVE-2025-32906), a double free vulnerability in soup_message_headers_get_content_disposition() (CVE-2025-32911), a null pointer dereference in the same function when a filename parameter is present but empty (CVE-2025-32913), information disclosure due to sending Authorization headers to different hosts on redirects (CVE-2025-46421), and a memory leak in soup_header_parse_quality_list() (CVE-2025-46420). Red Hat has released an important security update for Red Hat Enterprise Linux 8 to address these issues. The update is available for multiple architectures and includes fixes for all listed CVEs. Users are advised to apply the update as detailed in the Red Hat advisory RHSA-2025:4560.

These vulnerabilities collectively could lead to memory corruption issues such as buffer overflows, double frees, and null pointer dereferences, which may cause application crashes or potentially allow code execution. The information disclosure vulnerability may cause the libsoup client to send sensitive Authorization headers to unintended hosts during HTTP redirects. Memory leaks could degrade application performance over time. No known exploits in the wild have been reported, but the presence of multiple memory safety issues indicates a high security impact.

Red Hat has released an important security update for libsoup in Red Hat Enterprise Linux 8 that addresses all identified vulnerabilities. Users should apply the update as soon as possible following the instructions in the Red Hat advisory RHSA-2025:4560 (https://access.redhat.com/articles/11258). The update is available for multiple architectures including x86_64, s390x, ppc64le, and aarch64. No additional mitigation steps are indicated by the vendor advisory.