A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.
The vulnerability results from improper memory management in the soup_message_headers_get_content_disposition() function — classified as CWE-590 (use-after-free). A malicious HTTP client can send a specially crafted HTTP request that causes a reference to an already freed memory area. This results in memory corruption of the server process running the libsoup library.
An attacker can cause memory corruption on the HTTP server, potentially leading to arbitrary code execution (RCE), takeover of the server process, or disclosure of sensitive data. Due to the scope of impact (Scope: Changed), the consequences may extend beyond the libsoup process itself.
Patches available from the vendor should be applied according to references — Red Hat has provided fixes in errata RHSA-2025:21657, RHSA-2025:4439, RHSA-2025:4440, RHSA-2025:4508, and RHSA-2025:4538. Immediate update of the libsoup package is recommended on all Red Hat/RHEL-based systems and derivative distributions.
The libsoup library — specific versions indicated in vendor references (Red Hat Security Advisory: RHSA-2025:21657, RHSA-2025:4439, RHSA-2025:4440, RHSA-2025:4508, RHSA-2025:4538)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H