CVE-2025-32907

Public on 2025-04-14
Modified on 2025-04-16
Description
A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory.
Severity
Important severity
Important
CVSS v3 Base Score
7.5
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 1 libsoup 2025-05-21 ALAS-2025-1979 Fixed
Amazon Linux 2 - Core libsoup 2025-05-08 ALAS2-2025-2849 Fixed
Amazon Linux 2023 libsoup 2025-05-07 ALAS2023-2025-962 Fixed
Amazon Linux 2023 libsoup3 2025-05-07 ALAS2023-2025-961 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD CVSSv3 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L