CVE-2025-32912: libsoup SoupAuthDigest DoS Vulnerability

CVE-2025-32912 Overview

A NULL pointer dereference vulnerability has been identified in libsoup, specifically within the SoupAuthDigest component. This flaw allows a malicious HTTP server to cause libsoup client applications to crash, resulting in a denial of service condition. The vulnerability affects applications that utilize libsoup for HTTP communication and implement digest authentication.

Critical Impact

A remote attacker operating a malicious HTTP server can trigger a NULL pointer dereference in libsoup clients, causing application crashes and denial of service without requiring authentication.

Affected Products

• libsoup (HTTP client/server library for GNOME)
• Applications utilizing libsoup for HTTP communication
• Linux distributions shipping vulnerable libsoup versions (Red Hat, Debian, and derivatives)

Discovery Timeline

• 2025-04-14 - CVE-2025-32912 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-32912

Vulnerability Analysis

This vulnerability falls under CWE-476 (NULL Pointer Dereference), a memory corruption issue that occurs when a program attempts to dereference a pointer that has not been properly initialized or has been set to NULL. In the context of libsoup's SoupAuthDigest implementation, the flaw manifests during the processing of HTTP digest authentication responses from a server.

The attack can be initiated remotely over a network connection and requires user interaction (the client must connect to the malicious server). When successfully exploited, the vulnerability affects the availability of the client application but does not compromise confidentiality or integrity of data.

Root Cause

The root cause lies in insufficient validation of server-provided authentication parameters within the SoupAuthDigest authentication handler. When libsoup processes a digest authentication challenge from an HTTP server, certain fields are expected to contain valid data. If a malicious server sends a crafted response with missing or malformed authentication parameters, the code path may attempt to access a NULL pointer, triggering an immediate crash of the client application.

This type of vulnerability typically occurs when defensive programming practices such as NULL checks are missing before pointer dereference operations in authentication parsing routines.

Attack Vector

The attack requires a victim's application using libsoup to connect to an attacker-controlled HTTP server. The attack sequence involves:

1. The attacker sets up a malicious HTTP server configured to respond with crafted digest authentication challenges
2. When a libsoup-based client connects and requests a resource requiring authentication, the server responds with a malformed WWW-Authenticate header
3. The SoupAuthDigest component processes the malformed response and attempts to dereference a NULL pointer
4. The client application crashes, resulting in denial of service

The vulnerability is network-exploitable but requires user interaction—the victim must initiate a connection to the malicious server, potentially through social engineering or by embedding malicious URLs in content.

Detection Methods for CVE-2025-32912

Indicators of Compromise

• Unexpected crashes in applications utilizing libsoup for HTTP requests
• Core dumps or crash reports referencing SoupAuthDigest or related authentication functions
• Segmentation fault signals (SIGSEGV) in libsoup-dependent applications
• Application logs showing failed connections followed by abrupt termination

Detection Strategies

• Monitor application crash logs for patterns indicating NULL pointer dereference in libsoup components
• Implement network monitoring to detect unusual HTTP 401 responses with malformed WWW-Authenticate headers
• Deploy endpoint detection to identify repeated crashes of libsoup-based applications
• Audit network traffic for connections to untrusted or newly-registered domains from applications using libsoup

Monitoring Recommendations

• Enable crash reporting and analysis for all applications utilizing libsoup
• Configure system monitoring to alert on abnormal process termination rates
• Implement network security monitoring for HTTP authentication anomalies
• Review logs from web-accessing applications for patterns of failed authentication followed by crashes

How to Mitigate CVE-2025-32912

Immediate Actions Required

• Update libsoup to the latest patched version available from your distribution
• Review and restrict which external URLs your applications can access
• Consider implementing application-level restart mechanisms to maintain service availability
• Audit applications in your environment that depend on libsoup for HTTP functionality

Patch Information

Security patches addressing this vulnerability have been released by major Linux distributions. Organizations should apply the following updates based on their environment:

• Red Hat: Refer to Red Hat Security Advisory RHSA-2025:7505 for patched package versions
• Debian: See the Debian LTS Security Announcement for update instructions

Additional technical details and tracking information can be found at:

• Red Hat CVE Database Entry
• Red Hat Bugzilla #2359356

Workarounds

• Restrict network access for libsoup-based applications to trusted servers only
• Implement network-level filtering to block connections to untrusted or suspicious hosts
• Deploy application sandboxing to limit the impact of potential crashes
• Configure process supervision to automatically restart crashed applications to maintain availability
• Consider temporarily disabling digest authentication if not required for your use case

# Check installed libsoup version on Red Hat/CentOS/Fedora
rpm -qa | grep libsoup

# Check installed libsoup version on Debian/Ubuntu
dpkg -l | grep libsoup

# Update libsoup on Red Hat-based systems
sudo dnf update libsoup --security

# Update libsoup on Debian-based systems
sudo apt-get update && sudo apt-get upgrade libsoup2.4-1