Libsoup3, a C-based HTTP library used in GNOME applications, contains several vulnerabilities: a heap buffer over-read in skip_insignificant_space (CVE-2025-2784), out-of-bounds reads in soup_headers_parse_request() (CVE-2025-32906), denial of service via HTTP/2 server interactions (CVE-2025-32908), NULL pointer dereference when the server omits the nonce parameter in Digest authentication (CVE-2025-32912), out-of-bounds read in soup_multipart_new_from_message causing crashes (CVE-2025-32914), and information disclosure due to sending Authorization headers to incorrect hosts on redirects (CVE-2025-46421). Red Hat Product Security has released an update for Red Hat Enterprise Linux 10 to address these vulnerabilities.

These vulnerabilities can lead to application crashes, denial of service conditions, heap buffer over-reads, out-of-bounds memory reads, NULL pointer dereferences, and potential information disclosure through improper handling of HTTP headers. The issues affect the stability and confidentiality of applications using libsoup3 for HTTP communications.

Red Hat has released security updates for libsoup3 in Red Hat Enterprise Linux 10 and related variants. Users should apply the official Red Hat update RHSA-2025:7505 to remediate these vulnerabilities. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided patch.