CVE-2025-32053: libsoup Buffer Overflow Vulnerability

CVE-2025-32053 Overview

CVE-2025-32053 is a heap buffer over-read vulnerability in libsoup, the HTTP client/server library used by GNOME and many Linux applications. The flaw resides in the sniff_feed_or_html() and skip_insignificant_space() functions, which fail to properly validate buffer boundaries when processing certain HTTP content. An attacker who can deliver crafted HTTP responses or content to a libsoup-based client may trigger reads past the end of a heap allocation. This can lead to information disclosure of adjacent memory or cause the affected process to crash. The weakness is tracked under CWE-126: Buffer Over-read.

Critical Impact
Remote attackers can trigger a heap buffer over-read in libsoup clients through crafted HTTP content, resulting in memory disclosure or denial of service.

Affected Products

GNOME libsoup HTTP library
Red Hat Enterprise Linux packages shipping libsoup (see Red Hat CVE-2025-32053 Details)
Debian and Debian LTS distributions shipping libsoup (see Debian LTS Announcement April 2025)

Discovery Timeline

2025-04-03 - CVE-2025-32053 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2025-32053

Vulnerability Analysis

The vulnerability affects the content-sniffing and whitespace-skipping code paths inside libsoup. When libsoup receives HTTP response bodies, it attempts to determine the media type by inspecting the first bytes of the payload. The sniff_feed_or_html() function inspects the buffer to differentiate feed and HTML content, while skip_insignificant_space() advances past whitespace before further parsing.

Both functions rely on pointer arithmetic against the response buffer without consistently enforcing the upper bound of the allocation. A crafted response can cause the sniffer to read one or more bytes beyond the end of the heap buffer. The over-read leaks adjacent heap memory into subsequent parsing decisions and can crash the client process when the read strays into an unmapped page.

Root Cause

The root cause is missing length validation in loops that scan the sniffing buffer. The functions increment their read cursor based on the content of the buffer rather than a strict remaining-length check. When the crafted input omits the expected terminating bytes, the cursor advances past the allocation boundary, producing an out-of-bounds read classified as [CWE-126].

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker delivers a specially crafted HTTP response, feed, or HTML document to any application that uses libsoup to fetch remote content. This includes browsers, RSS readers, GNOME applications, and network services that embed libsoup as an HTTP client. Because the flaw is triggered during content sniffing, the payload does not need to be rendered — merely fetched.

No verified public exploit code was available at the time of publication. Technical details are documented in the GNOME Issue Tracker #426 and Red Hat Bugzilla Report #2357070.

Detection Methods for CVE-2025-32053

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linked against libsoup such as evolution, gnome-software, or feed readers.
HTTP client logs recording responses with malformed or truncated Content-Type sniffing candidates from untrusted origins.
Repeated fetches from suspicious hosts serving small, malformed HTML or feed payloads to libsoup consumers.

Detection Strategies

Inventory installed libsoup package versions across Linux endpoints and compare against fixed versions listed in Red Hat Security Advisory RHSA-2025:4440 and the Debian LTS Announcement April 2025.
Enable AddressSanitizer or similar heap-guard tooling in test environments to surface out-of-bounds reads originating in sniff_feed_or_html().
Correlate application crash telemetry with outbound HTTP fetches to non-corporate destinations.

Monitoring Recommendations

Monitor systemd-coredump and journalctl output for repeated crashes involving libsoup symbols.
Alert on network egress from desktop hosts to previously unseen domains delivering feed or HTML content.
Track package update compliance for libsoup2 and libsoup3 across all managed Linux systems.

How to Mitigate CVE-2025-32053

Immediate Actions Required

Apply the vendor patches for libsoup published by Red Hat and Debian, then restart applications that link the library.
Prioritize patching internet-facing hosts and user endpoints that fetch third-party feeds or HTML.
Restart long-running services such as evolution-data-server after upgrade to ensure the patched library is loaded.

Patch Information

Fixed packages are available in the following advisories: RHSA-2025:4440, RHSA-2025:4508, RHSA-2025:4560, RHSA-2025:4568, RHSA-2025:7436, and RHSA-2025:8292. Debian users should follow the Debian LTS Announcement April 2025.

Workarounds

Restrict outbound HTTP from applications that use libsoup to trusted destinations via egress filtering where feasible.
Disable optional feed or content-fetching features in affected applications until patches are deployed.
Run vulnerable services under systemd sandboxing directives such as MemoryDenyWriteExecute=yes and ProtectSystem=strict to limit blast radius.

bash

# Update libsoup on Red Hat Enterprise Linux
sudo dnf update libsoup libsoup3
sudo systemctl restart evolution-data-server.service

# Update libsoup on Debian / Ubuntu
sudo apt-get update
sudo apt-get install --only-upgrade libsoup2.4-1 libsoup-3.0-0

# Verify installed version
rpm -q libsoup libsoup3        # RHEL / Fedora
dpkg -l | grep libsoup          # Debian / Ubuntu