The libsoup library for GNOME contains several security vulnerabilities, including an integer overflow in append_param_quoted (CVE-2025-32050), heap buffer overflows in sniff_unknown (CVE-2025-32052) and sniff_feed_or_html and skip_insignificant_space (CVE-2025-32053), out-of-bounds reads in soup_headers_parse_request (CVE-2025-32906), denial of service via large overlapping Range header requests (CVE-2025-32907), double free in soup_message_headers_get_content_disposition (CVE-2025-32911), null pointer dereference in the same function when a filename parameter is present but empty (CVE-2025-32913), information disclosure due to sending Authorization header to a different host on redirect (CVE-2025-46421), and a memory leak in soup_header_parse_quality_list (CVE-2025-46420). These vulnerabilities affect Red Hat Enterprise Linux 9.4 Extended Update Support and related product variants. Red Hat has issued a security advisory RHSA-2025:4440 with an update that fixes these issues.

These vulnerabilities collectively could lead to memory corruption (integer overflow, heap buffer overflow, double free, null pointer dereference), denial of service conditions, information disclosure, and memory leaks in applications using libsoup. The impact severity is rated as Important by Red Hat. Exploitation could cause application crashes or potentially expose sensitive information. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update for libsoup in Red Hat Enterprise Linux 9.4 Extended Update Support and related variants. Applying the update as described in Red Hat advisory RHSA-2025:4440 will remediate these vulnerabilities. Users should follow the instructions at https://access.redhat.com/articles/11258 to apply the update. No additional mitigation steps are indicated by the vendor.