CVE-2025-32911: libsoup Use-After-Free Vulnerability

CVE-2025-32911 Overview

A use-after-free vulnerability was discovered in libsoup, specifically within the soup_message_headers_get_content_disposition() function. This critical flaw allows a malicious HTTP client to cause memory corruption in the libsoup server, potentially leading to arbitrary code execution or denial of service conditions.

Critical Impact

This use-after-free vulnerability enables remote attackers to corrupt server memory through malicious HTTP requests, potentially allowing complete system compromise without authentication.

Affected Products

• libsoup (GNOME HTTP library)
• Red Hat Enterprise Linux distributions using libsoup
• Debian and Debian-based distributions using libsoup

Discovery Timeline

• April 15, 2025 - CVE-2025-32911 published to NVD
• November 18, 2025 - Last updated in NVD database

Technical Details for CVE-2025-32911

Vulnerability Analysis

This vulnerability is classified under CWE-590 (Free of Memory not on the Heap), indicating improper memory management within the affected function. The soup_message_headers_get_content_disposition() function fails to properly handle memory lifecycle, resulting in a use-after-free condition when processing HTTP Content-Disposition headers.

The vulnerability is particularly dangerous because it can be triggered remotely over the network by any malicious HTTP client connecting to a vulnerable libsoup-based server. No authentication or user interaction is required to exploit this flaw, and successful exploitation can affect resources beyond the security scope of the vulnerable component.

Root Cause

The root cause of CVE-2025-32911 lies in improper memory management within the soup_message_headers_get_content_disposition() function. When parsing Content-Disposition headers from HTTP requests, the function incorrectly frees memory that may still be referenced elsewhere in the application. This creates a dangling pointer that, when subsequently accessed, leads to use-after-free conditions.

The CWE-590 classification indicates that the vulnerability involves freeing memory that was not allocated from the heap in the expected manner, leading to memory corruption when the freed region is later accessed or when the memory allocator attempts to reuse the corrupted heap metadata.

Attack Vector

An attacker can exploit this vulnerability by sending specially crafted HTTP requests to a server using the vulnerable libsoup library. The attack targets the Content-Disposition header parsing functionality:

1. The attacker crafts a malicious HTTP request with a specially formed Content-Disposition header
2. The vulnerable soup_message_headers_get_content_disposition() function processes the header
3. Memory is freed prematurely while references to it still exist
4. Subsequent operations access the freed memory, causing corruption
5. The attacker may leverage the memory corruption to achieve code execution or crash the server

The network-based attack vector means any internet-facing service using libsoup could be targeted remotely. While the attack complexity is high, successful exploitation can result in complete confidentiality, integrity, and availability compromise of the affected system.

Detection Methods for CVE-2025-32911

Indicators of Compromise

• Unexpected server crashes or segmentation faults in applications using libsoup
• Anomalous HTTP requests with malformed or unusually complex Content-Disposition headers
• Memory corruption errors or heap corruption warnings in system logs
• Unusual process behavior following HTTP request processing

Detection Strategies

• Deploy network intrusion detection rules to identify malformed Content-Disposition headers in HTTP traffic
• Enable memory debugging tools (AddressSanitizer, Valgrind) in non-production environments to detect use-after-free conditions
• Monitor application logs for heap corruption errors or unexpected terminations related to libsoup components
• Implement application-level logging for Content-Disposition header parsing activities

Monitoring Recommendations

• Configure continuous monitoring for libsoup-dependent services to detect service disruptions
• Set up alerting for abnormal HTTP request patterns targeting server endpoints
• Monitor system logs for core dumps or crash reports from applications using libsoup
• Track network traffic for reconnaissance activity targeting HTTP header parsing

How to Mitigate CVE-2025-32911

Immediate Actions Required

• Update libsoup to the latest patched version provided by your distribution vendor
• Review and apply security advisories from Red Hat and Debian
• Inventory all systems and applications dependent on libsoup to prioritize patching
• Consider temporarily restricting network access to vulnerable services until patches can be applied

Patch Information

Multiple vendors have released security advisories and patches for this vulnerability:

• Red Hat: Multiple advisories including RHSA-2025:4439, RHSA-2025:4440, RHSA-2025:4508, RHSA-2025:4538, and additional updates. Refer to Red Hat Bug Report #2359355 for technical details.
• Debian: Security update announced via Debian LTS

Organizations should apply the appropriate patches for their distributions immediately given the critical severity of this vulnerability.

Workarounds

• Implement network-level filtering to restrict HTTP client access to vulnerable services
• Deploy a Web Application Firewall (WAF) with rules to inspect and sanitize Content-Disposition headers
• Place vulnerable services behind a reverse proxy that can validate and normalize HTTP headers before forwarding
• Consider temporarily disabling or removing functionality that relies on Content-Disposition header parsing if feasible

# Example: Check installed libsoup version on Red Hat/CentOS systems
rpm -qa | grep libsoup

# Example: Update libsoup on RHEL/CentOS
sudo yum update libsoup

# Example: Update libsoup on Debian/Ubuntu
sudo apt-get update && sudo apt-get upgrade libsoup2.4-1