CVE-2025-32051: libsoup DOS Vulnerability

CVE-2025-32051 Overview

CVE-2025-32051 is a denial-of-service flaw in libsoup, the HTTP client/server library widely used by GNOME applications and other Linux software. The soup_uri_decode_data_uri() function may crash when processing a malformed data: URI. An attacker who can supply a crafted URI to an application linked against libsoup can trigger the crash and disrupt service availability. The issue is tracked as an improper check for unusual or exceptional conditions [CWE-754] and was published to the National Vulnerability Database on April 3, 2025.

Critical Impact
Remote attackers can crash any application that parses untrusted data: URIs through libsoup, resulting in denial of service on the affected host process.

Affected Products

GNOME libsoup HTTP library
Linux distributions that ship libsoup (including Red Hat Enterprise Linux)
Applications that call soup_uri_decode_data_uri() on untrusted input

Discovery Timeline

2025-04-03 - CVE-2025-32051 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2025-32051

Vulnerability Analysis

The defect resides in soup_uri_decode_data_uri(), the helper that parses RFC 2397 data: URIs into their MIME type and payload components. When the function receives a malformed URI, it fails to validate an exceptional condition before dereferencing the parsed result. The library then aborts the calling process, producing a denial-of-service condition.

The attack requires network reachability but no privileges or user interaction on the target application. Exploitation is limited to availability impact; confidentiality and integrity are not affected. The complexity is elevated because the attacker must deliver the malformed URI to a code path that invokes the vulnerable decoder.

Root Cause

The root cause is an improper check for unusual or exceptional conditions during data: URI parsing. soup_uri_decode_data_uri() proceeds past a failed validation step and operates on an invalid or partial parse result, causing a crash inside the library. The issue is documented in the GNOME libsoup Issue #401 tracker and the Red Hat Bug Report #2357068.

Attack Vector

Exploitation is remote and unauthenticated. An attacker delivers a malformed data: URI to any application that hands the string to libsoup for decoding. Common exposure paths include HTTP clients following user-supplied links, feed readers, chat clients, and desktop applications rendering remote content. The crashing process terminates immediately, denying service until it is restarted.

See the Red Hat CVE-2025-32051 Advisory for vendor-specific technical details. No public proof-of-concept exploit is currently listed.

Detection Methods for CVE-2025-32051

Indicators of Compromise

Unexpected termination or repeated crash signals (SIGABRT, SIGSEGV) in processes linked against libsoup
Core dumps whose stack traces reference soup_uri_decode_data_uri or nearby URI parsing routines
Application or system logs showing repeated restarts of GNOME components or libsoup-consuming daemons

Detection Strategies

Inventory installed libsoup versions across Linux endpoints and compare against fixed package versions from your distribution vendor
Correlate process crash telemetry with inbound requests containing data: URIs to identify targeting attempts
Review application logs for malformed URI parsing errors preceding process termination

Monitoring Recommendations

Enable core dump collection and forward stack traces to a central log store for triage
Alert on abnormal crash rates for user-facing applications that process remote content through libsoup
Track package inventory changes to confirm patched libsoup versions are deployed across the fleet

How to Mitigate CVE-2025-32051

Immediate Actions Required

Apply the libsoup security update from your Linux distribution as soon as it is available
Restart all services and desktop sessions that link against libsoup so the patched library is loaded
Audit applications that accept remote URIs and restrict exposure to untrusted sources where possible

Patch Information

Red Hat and other distribution maintainers are tracking the fix through the upstream GNOME project. Consult the Red Hat CVE-2025-32051 Advisory and the upstream GNOME libsoup Issue #401 for current patch status and fixed package versions. Install updates through the standard package manager (dnf, apt, zypper) once your vendor publishes the fixed build.

Workarounds

Disable or filter data: URI handling in applications that do not require it
Place network-facing services that parse untrusted URIs behind a reverse proxy or WAF that strips or validates data: schemes
Run vulnerable services under a process supervisor that restarts them after a crash to limit sustained downtime

bash

# Verify installed libsoup version on RPM-based systems
rpm -q libsoup libsoup3

# Verify installed libsoup version on Debian-based systems
dpkg -l | grep -i libsoup

# Apply available updates
sudo dnf update libsoup libsoup3   # RHEL / Fedora
sudo apt update && sudo apt upgrade libsoup2.4-1 libsoup-3.0-0   # Debian / Ubuntu