The libsoup library, developed by the GNOME project, has revealed 14 vulnerabilities. Libsoup provides implementations of HTTP client and server using GObjects for integration with GNOME applications. The library is used in GNOME Shell, the Epiphany browser (GNOME Web), the Shotwell image viewer, in the GStreamer plugin souphttpsrc, and in applications that utilize libwebkit2gtk. Previously, libsoup was used in NetworkManager, which has been transitioned to libcurl since version 1.8.
One of the vulnerabilities (CVE-2025-32911) leads to a double-free condition in the function soup_message_headers_get_content_disposition() and could theoretically be exploited for remote code execution when processing specially crafted HTTP client requests to server, utilizing libsoup. The issue has been fixed in libsoup version 3.6.3.
12 issues lead to buffer overflows during read operations or dereferencing a NULL pointer, which can result in denial of service (an attacker could crash an application using libsoup). One issue (CVE-2025-32907) arises from improper handling of the Range header, allowing a client to initiate excessive memory consumption on server.
Source: opennet.ru
