CVE-2025-32907: libsoup HTTP Range DoS Vulnerability

CVE-2025-32907 Overview

A flaw in libsoup, the HTTP client/server library used across the GNOME ecosystem and many Linux applications, allows remote attackers to trigger excessive memory consumption on the server. The vulnerability resides in the implementation of HTTP range requests. A malicious client can request the same byte range many times within a single HTTP request, forcing the server to allocate large amounts of memory to service the duplicated ranges. The issue is tracked under [CWE-1050] and does not permit a full denial of service, but it degrades service availability on affected hosts.

Critical Impact
Remote unauthenticated clients can exhaust server memory by sending crafted HTTP range requests, degrading availability of any service backed by libsoup.

Affected Products

GNOME libsoup (see GNOME Issue #428 for libsoup)
Red Hat Enterprise Linux distributions shipping libsoup (per Red Hat CVE Detail CVE-2025-32907)
Applications and services embedding libsoup as an HTTP server component

Discovery Timeline

2025-04-14 - CVE-2025-32907 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2025-32907

Vulnerability Analysis

The vulnerability is a resource consumption flaw in the HTTP range request handler of libsoup. HTTP range requests allow clients to request one or more byte ranges of a resource through the Range header. The libsoup server-side implementation processes each requested range independently and allocates memory to buffer the corresponding response segment. The server does not deduplicate or cap the number of overlapping or identical ranges submitted in one request.

When a client submits a Range header containing the same byte range repeated many times, the server allocates memory for each duplicated range. Memory usage grows linearly with the number of duplicate range entries. The impact is limited to availability degradation rather than a hard denial of service, which is consistent with the medium severity rating and the availability-only impact reflected in the CVSS vector.

Root Cause

The root cause is missing validation and deduplication of client-supplied range specifiers in the HTTP request parser. The server accepts arbitrarily long Range header values and processes each entry without enforcing a limit on total ranges, duplicate ranges, or aggregate response size. The exposed behavior belongs to CWE-1050 (Excessive Platform Resource Consumption within a Loop).

Attack Vector

An attacker connects to any HTTP service backed by libsoup and issues a single crafted GET request containing a Range header with the same byte range repeated many times, for example Range: bytes=0-100,0-100,0-100,.... The server allocates a buffer for each duplicated range, driving memory pressure on the host. No authentication or user interaction is required, and the request can be delivered over the network. The EPSS score for this CVE is 0.605% (percentile 44.67), indicating low observed exploitation likelihood as of the scoring date.

No verified public proof-of-concept code is available.
See the GNOME upstream issue and Red Hat bug report for technical details:
 - https://gitlab.gnome.org/GNOME/libsoup/-/issues/428
 - https://bugzilla.redhat.com/show_bug.cgi?id=2359342

Detection Methods for CVE-2025-32907

Indicators of Compromise

HTTP requests containing Range headers with unusually large numbers of comma-separated byte ranges, particularly repeated identical ranges.
Sudden, sustained growth in resident memory of libsoup-backed services (for example gnome-user-share, rygel, or custom applications linking libsoup).
Repeated inbound requests from the same source IP producing outsized response processing time or 5xx errors.

Detection Strategies

Parse HTTP access logs and reverse proxy logs for Range headers exceeding a reasonable range count threshold (for example more than 10 ranges).
Alert on processes linking libsoup whose RSS grows beyond an established baseline while handling active connections.
Correlate spikes in memory allocation with concurrent inbound HTTP traffic from a single source using flow telemetry.

Monitoring Recommendations

Enable verbose request logging on libsoup-based services during triage to capture full Range header contents.
Monitor OOM killer events and cgroup memory pressure signals on hosts running libsoup applications.
Track the installed libsoup package version against the fixed versions published in the Red Hat advisories referenced below.

How to Mitigate CVE-2025-32907

Immediate Actions Required

Inventory all systems and containers running libsoup or applications linked against it, using package managers or SBOM data.
Apply the vendor-supplied libsoup update from your Linux distribution as soon as it is available.
Restrict network exposure of libsoup-backed HTTP services to trusted networks until patches are applied.

Patch Information

Red Hat has published fixes across multiple product streams. Refer to Red Hat Security Advisory RHSA-2025:4439, Red Hat Security Advisory RHSA-2025:4440, Red Hat Security Advisory RHSA-2025:4508, Red Hat Security Advisory RHSA-2025:7436, Red Hat Security Advisory RHSA-2025:8128, and Red Hat Security Advisory RHSA-2025:8292. Upstream fix tracking is available in GNOME Issue #428 for libsoup and Red Hat Bug Report #2359342.

Workarounds

Front libsoup services with a reverse proxy (for example nginx or HAProxy) that strips or normalizes overly complex Range headers.
Enforce per-process memory limits using systemd MemoryMax= or cgroup v2 to contain the impact of memory exhaustion.
Rate-limit inbound HTTP requests per source IP to reduce the effectiveness of repeated malicious range requests.

bash

# Example nginx configuration: drop requests with excessively long Range headers
map $http_range $blocked_range {
    default 0;
    "~,.*,.*,.*,.*,.*,.*,.*,.*,.*," 1;  # more than ~10 ranges
}

server {
    listen 443 ssl;
    if ($blocked_range) { return 400; }
    location / {
        proxy_pass http://libsoup_backend;
    }
}