CVE-2024-52532: Gnome Libsoup DOS Vulnerability

CVE-2024-52532 Overview

CVE-2024-52532 is a denial-of-service vulnerability in GNOME libsoup versions before 3.6.1. The library, used widely across the GNOME ecosystem for HTTP client and server functionality, enters an infinite loop and consumes memory when processing specific WebSocket data patterns sent by clients. A remote, unauthenticated attacker can exploit this flaw by sending crafted WebSocket frames to any service that uses libsoup for WebSocket handling. The issue is tracked as [CWE-835] (Loop with Unreachable Exit Condition).

Critical Impact

Remote, unauthenticated attackers can cause complete service unavailability by exhausting CPU and memory on hosts running vulnerable libsoup WebSocket endpoints.

Affected Products

• GNOME libsoup versions before 3.6.1
• Debian LTS distributions shipping vulnerable libsoup packages
• Applications and services that embed libsoup for WebSocket server functionality

Discovery Timeline

• 2024-11-11 - CVE-2024-52532 published to NVD
• 2024-12 - Debian LTS advisory released for affected packages
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-52532

Vulnerability Analysis

The vulnerability resides in libsoup's WebSocket data reading logic. When the library processes certain patterns of inbound WebSocket frames, the read loop fails to terminate. The process continues consuming CPU cycles and allocating memory until system resources are exhausted. Because libsoup is a foundational HTTP library used by GNOME applications and many third-party services, the attack surface extends to any application that exposes WebSocket endpoints backed by the library. Exploitation requires no authentication, no user interaction, and only network reachability to the WebSocket service.

Root Cause

The defect is classified as [CWE-835] — an infinite loop caused by an unreachable exit condition in the WebSocket frame parsing path. Specific frame patterns cause the parser to repeatedly re-enter its read state without consuming or rejecting the malformed input. The fix is implemented in GNOME Merge Request #410, which corrects the loop termination logic. The underlying issue is documented in GNOME Issue #391.

Attack Vector

An attacker establishes a WebSocket connection to a vulnerable service and transmits the triggering data pattern. The server-side libsoup parser enters the infinite loop and ceases responding to other clients. Sustained or repeated connections amplify resource exhaustion until the host becomes unresponsive. Refer to the GNOME Issue #391 tracker for technical details on the exact frame patterns involved.

Detection Methods for CVE-2024-52532

Indicators of Compromise

• Sustained 100% CPU utilization by processes linked against libsoup
• Rapid memory growth in libsoup-based daemons without corresponding request throughput
• WebSocket connections that remain open with no further frame exchange after initial handshake
• Application logs showing stalled WebSocket sessions or unresponsive worker threads

Detection Strategies

• Inventory installed libsoup versions across Linux fleets and flag any below 3.6.1
• Monitor WebSocket-capable services for abnormal CPU and memory consumption patterns
• Inspect network traffic for anomalous WebSocket frame sequences targeting libsoup-backed endpoints
• Correlate process resource metrics with active WebSocket client counts to identify asymmetric consumption

Monitoring Recommendations

• Configure resource alerts on processes that link libsoup.so for sudden CPU saturation
• Enable application-level WebSocket frame logging where supported to capture malformed patterns
• Track memory growth rates of long-running libsoup services and alert on linear unbounded growth

How to Mitigate CVE-2024-52532

Immediate Actions Required

• Upgrade libsoup to version 3.6.1 or later on all affected systems
• Apply distribution updates referenced in the Debian LTS announcement and equivalent advisories from other vendors
• Restart all services that link against libsoup after patching to ensure the updated library is loaded
• Inventory third-party applications that bundle libsoup and apply vendor-supplied updates

Patch Information

The fix is delivered in libsoup 3.6.1 via GNOME Merge Request #410. Linux distribution maintainers have backported the patch to supported branches. Consult the GNOME Security Wiki for the authoritative list of fixed versions.

Workarounds

• Restrict WebSocket endpoint exposure to trusted networks until patching is complete
• Deploy a reverse proxy or WAF capable of rate-limiting WebSocket connections and frames
• Enforce per-process resource limits using systemdMemoryMax and CPUQuota directives to contain impact

# Configuration example: systemd resource limits for a libsoup-based service
[Service]
MemoryMax=512M
CPUQuota=50%
TasksMax=128
Restart=on-failure