CVE-2025-32908: libsoup HTTP/2 DoS Vulnerability

CVE-2025-32908 Overview

CVE-2025-32908 is a denial of service vulnerability in libsoup, the GNOME HTTP client/server library used across Linux desktop and server software. The HTTP/2 server implementation in libsoup fails to fully validate the values of the :scheme, :authority, and :path pseudo-headers. A remote, unauthenticated attacker can send a malformed HTTP/2 request that causes the server process to terminate or become unresponsive. The flaw is tracked under CWE-115: Misinterpretation of Input and affects any application that embeds libsoup as an HTTP/2 server.

Critical Impact

Remote attackers can trigger a denial of service against any HTTP/2 server built on libsoup without authentication or user interaction.

Affected Products

• libsoup HTTP/2 server implementations
• Red Hat Enterprise Linux distributions consuming libsoup (see RHSA-2025:7505)
• GNOME applications and services that expose HTTP/2 endpoints via libsoup

Discovery Timeline

• 2025-04-14 - CVE-2025-32908 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-32908

Vulnerability Analysis

The vulnerability resides in the HTTP/2 request parsing logic of libsoup. HTTP/2 defines a set of pseudo-headers (prefixed with a colon) that carry routing information equivalent to the HTTP/1.1 request line. The three affected pseudo-headers, :scheme, :authority, and :path, identify the target resource for each stream.

libsoup accepts these pseudo-headers without strict validation against the grammar defined in RFC 9113. When the server later attempts to interpret malformed values during request dispatch, the code path reaches an unexpected state and aborts the worker process. The flaw maps to CWE-115, where input is interpreted under assumptions the parser does not enforce.

Root Cause

The HTTP/2 server code in libsoup treats pseudo-header values as well-formed strings instead of validating them against the protocol grammar. Empty values, invalid characters, or unexpected token sequences propagate downstream into request handling, where they trigger assertion failures or unrecoverable error states that crash the server.

Attack Vector

Exploitation requires only network reachability to an HTTP/2 endpoint backed by libsoup. The attacker opens an HTTP/2 connection, performs the standard preface and SETTINGS exchange, and submits a HEADERS frame containing crafted :scheme, :authority, or :path values. No authentication, privileges, or user interaction are required. Successful requests stop the service from handling further connections until it is restarted. No verified public proof-of-concept code is available at this time; review the Red Hat CVE-2025-32908 advisory and Bugzilla #2359343 for upstream details.

Detection Methods for CVE-2025-32908

Indicators of Compromise

• Unexpected crashes or restarts of services that link against libsoup and expose HTTP/2
• HTTP/2 GOAWAY frames with error codes followed by abrupt connection terminations from the server side
• Application logs showing parsing errors referencing :scheme, :authority, or :path pseudo-headers
• Repeated short-lived HTTP/2 connections from a single source preceding a service outage

Detection Strategies

• Inspect HTTP/2 traffic at the proxy or WAF layer for requests containing empty or non-conforming pseudo-header values
• Correlate process crash events for libsoup-backed daemons with inbound HTTP/2 connection bursts
• Enable verbose logging in front-end reverse proxies to capture rejected HTTP/2 frames for forensic review

Monitoring Recommendations

• Alert on abnormal restart counts for services such as GNOME Online Accounts, Evolution, or custom daemons embedding libsoup
• Track HTTP/2 protocol error rates per source IP to identify probing or DoS attempts
• Monitor availability metrics for HTTP/2 endpoints and trigger alerts when error budgets degrade rapidly

How to Mitigate CVE-2025-32908

Immediate Actions Required

• Apply the vendor-supplied libsoup updates from RHSA-2025:7505 and equivalent distribution advisories
• Restart all services that link against libsoup after patching to ensure the updated library is loaded
• Audit the environment for applications that expose HTTP/2 endpoints via libsoup and prioritize externally reachable services

Patch Information

Red Hat released fixed packages in RHSA-2025:7505. Refer to the Red Hat CVE-2025-32908 page for affected component versions and to Bugzilla #2359343 for upstream tracking. Other Linux distributions have published corresponding libsoup updates; apply the version distributed by your vendor.

Workarounds

• Place a hardened reverse proxy in front of libsoup HTTP/2 endpoints to validate pseudo-headers before they reach the backend
• Disable HTTP/2 on affected services where feasible and fall back to HTTP/1.1 until patches are applied
• Restrict network exposure of libsoup-backed services to trusted clients using firewall rules or mutual TLS

# Example: update libsoup on Red Hat Enterprise Linux
sudo dnf update libsoup libsoup3
sudo systemctl restart <service-using-libsoup>