CVE-2025-32052: libsoup Buffer Overflow Vulnerability

CVE-2025-32052 Overview

CVE-2025-32052 is a heap buffer over-read vulnerability in libsoup, the HTTP client/server library used across the GNOME ecosystem and many Linux applications. The flaw resides in the sniff_unknown() content-sniffing function, which reads past the bounds of a heap buffer when processing untrusted HTTP response data. A remote attacker who serves crafted content to a libsoup-based client can trigger the over-read, potentially disclosing adjacent heap memory or crashing the process. The issue is tracked as CWE-126: Buffer Over-read and affects multiple Red Hat Enterprise Linux and Debian releases that ship libsoup.

Critical Impact
Remote attackers can trigger a heap buffer over-read in any client or service consuming HTTP responses through libsoup, leading to information disclosure or denial of service without authentication or user interaction.

Affected Products

GNOME libsoup HTTP library (sniff_unknown() code path)
Red Hat Enterprise Linux distributions shipping libsoup (see RHSA-2025:4440, RHSA-2025:4508, RHSA-2025:4560, RHSA-2025:4568, RHSA-2025:7436, RHSA-2025:8292)
Debian LTS releases shipping libsoup (see Debian LTS Announcement April 2025)

Discovery Timeline

2025-04-03 - CVE-2025-32052 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2025-32052

Vulnerability Analysis

libsoup implements MIME sniffing to guess the content type of HTTP responses when the server does not provide a definitive Content-Type header. The sniff_unknown() routine inspects the initial bytes of the response body against a set of signatures for HTML, binary, and media formats. When the response payload is shorter than the length assumed by one of these signature comparisons, the function reads beyond the end of the allocated heap buffer.

The over-read leaks adjacent heap memory into the sniffing logic and can leak into subsequent processing, exposing sensitive process data or triggering a crash. Because HTTP content sniffing runs before any application-level validation, the vulnerable code path is reached during normal request handling. Applications embedding libsoup — including web browsers, feed readers, and desktop integration services — inherit the exposure. See Red Hat CVE Analysis CVE-2025-32052 and GNOME Issue Discussion #425 for technical details.

Root Cause

The root cause is missing length validation in sniff_unknown() before signature comparison. The function assumes the response buffer contains at least as many bytes as the longest signature pattern, so short or truncated responses cause the comparison to reference memory outside the allocated buffer. This is a classic [CWE-126] buffer over-read pattern in a content-parsing routine.

Attack Vector

Exploitation requires an attacker-controlled HTTP server or the ability to inject a response into an unencrypted or man-in-the-middle position. When a libsoup client fetches a resource, the attacker returns a short response body with no Content-Type header, forcing libsoup into the sniffing branch. The malformed payload then drives the vulnerable comparison in sniff_unknown(). No authentication or user interaction is required beyond triggering an HTTP request to attacker-controlled content, which many desktop and background services do automatically.

No verified public exploit code is available. Refer to Red Hat Bug Report #2357069 for the upstream reproduction discussion.

Detection Methods for CVE-2025-32052

Indicators of Compromise

Repeated crashes or SIGSEGV signals in processes linked against libsoup-2.4 or libsoup-3.0, particularly in soup_content_sniffer_sniff or sniff_unknown frames
AddressSanitizer or Valgrind reports flagging heap-buffer-overflow reads inside libsoup during HTTP response parsing
Outbound HTTP connections from desktop or service processes to unexpected hosts returning short, header-light responses

Detection Strategies

Inventory installed libsoup packages across Linux endpoints and compare versions against the fixed builds listed in the Red Hat and Debian advisories
Monitor process crash telemetry for libsoup-linked binaries and correlate with recent HTTP activity in the same process
Inspect HTTP proxy or network logs for responses lacking a Content-Type header combined with unusually small payload sizes destined for libsoup-based clients

Monitoring Recommendations

Enable core-dump collection and forward crash artifacts to a central analysis pipeline to spot exploitation attempts against libsoup consumers
Alert on new or unexpected outbound HTTP destinations initiated by GNOME desktop components, evolution-data-server, or gnome-online-accounts
Track package inventory drift so unpatched libsoup versions reappearing on hosts trigger a vulnerability management ticket

How to Mitigate CVE-2025-32052

Immediate Actions Required

Apply the vendor-supplied libsoup updates from the Red Hat advisories (RHSA-2025:4440, RHSA-2025:4508, RHSA-2025:4560, RHSA-2025:4568, RHSA-2025:7436, RHSA-2025:8292) and the Debian LTS Announcement April 2025
Restart or reboot services and desktop sessions after upgrading so long-running processes stop using the vulnerable in-memory copy of libsoup
Prioritize patching servers and workstations that make outbound HTTP requests to untrusted networks or that expose libsoup-based services to the internet

Patch Information

Fixes are shipped as updated libsoup and libsoup3 packages by GNOME upstream and downstream distributions. Red Hat has released advisories covering the affected RHEL streams, and Debian has issued an LTS update. Consult the Red Hat CVE Analysis for CVE-2025-32052 for the full list of fixed package builds.

Workarounds

Where immediate patching is not possible, restrict libsoup-based clients to trusted HTTPS endpoints using host firewalls or egress proxies to reduce exposure to attacker-controlled responses
Disable or remove optional libsoup-consuming services that are not required, such as background feed or account synchronization daemons on server builds
Terminate long-running user sessions after upgrading system libraries to ensure applications load the patched libsoup at process start

bash

# Configuration example: verify libsoup is patched on Red Hat and Debian systems
rpm -q libsoup libsoup3 2>/dev/null || dpkg -l | grep -E 'libsoup2.4|libsoup-3.0'

# Apply vendor updates
sudo dnf update libsoup libsoup3           # RHEL / Fedora
sudo apt-get update && sudo apt-get install --only-upgrade libsoup2.4-1 libsoup-3.0-0   # Debian / Ubuntu