CVE-2025-32913: libsoup NULL Pointer DOS Vulnerability

CVE-2025-32913 Overview

A NULL pointer dereference vulnerability has been identified in libsoup, specifically within the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP peer to crash a libsoup client or server that uses this function, resulting in a denial of service condition. Libsoup is a widely-used HTTP client/server library for GNOME, making this vulnerability particularly impactful for Linux desktop environments and applications that rely on this library for HTTP communications.

Critical Impact

A remote attacker can crash libsoup-based clients or servers by sending specially crafted HTTP messages, causing service disruption without requiring authentication or user interaction.

Affected Products

• libsoup (GNOME HTTP library)
• Red Hat Enterprise Linux distributions with affected libsoup versions
• Debian Linux distributions with affected libsoup packages

Discovery Timeline

• 2025-04-14 - CVE-2025-32913 published to NVD
• 2025-11-18 - Last updated in NVD database

Technical Details for CVE-2025-32913

Vulnerability Analysis

This vulnerability is classified under CWE-476 (NULL Pointer Dereference). The flaw exists in the soup_message_headers_get_content_disposition() function, which parses the Content-Disposition header from HTTP messages. When processing malformed or specially crafted HTTP headers, the function fails to properly validate pointer values before dereferencing them, leading to a crash.

The attack can be executed remotely over the network without requiring any privileges or user interaction. The impact is limited to availability—there is no confidentiality or integrity breach—but the denial of service can be highly disruptive for applications and services relying on libsoup for HTTP communications.

Root Cause

The root cause stems from insufficient input validation in the soup_message_headers_get_content_disposition() function. When parsing Content-Disposition headers, the function does not adequately check whether internal data structures are properly initialized before attempting to dereference them. A malicious HTTP peer can send crafted headers that cause the function to attempt dereferencing a NULL pointer, triggering an immediate crash.

Attack Vector

The vulnerability is exploitable via network-based attacks. An attacker can exploit this flaw by:

1. Establishing an HTTP connection to a vulnerable libsoup server, or acting as a malicious server responding to a libsoup client
2. Sending an HTTP request or response containing a malformed Content-Disposition header
3. When the application calls soup_message_headers_get_content_disposition() to parse the header, the NULL pointer dereference occurs
4. The application crashes, resulting in denial of service

The attack requires no authentication and no user interaction, making it particularly dangerous for internet-facing services that process untrusted HTTP traffic.

Detection Methods for CVE-2025-32913

Indicators of Compromise

• Unexpected crashes or segmentation faults in applications using libsoup
• Core dumps showing NULL pointer dereference in soup_message_headers_get_content_disposition() or related functions
• Unusual HTTP traffic patterns with malformed Content-Disposition headers
• Repeated application restarts for libsoup-dependent services

Detection Strategies

• Monitor system logs for segmentation fault messages associated with libsoup-linked applications
• Implement application crash monitoring and alerting for services using libsoup
• Deploy network intrusion detection rules to identify malformed HTTP Content-Disposition headers
• Review crash dumps for NULL pointer dereference patterns in libsoup function calls

Monitoring Recommendations

• Enable core dump collection for libsoup-dependent applications to facilitate post-incident analysis
• Set up automated restart and alerting for critical services using libsoup
• Monitor for abnormal patterns of HTTP requests with unusual Content-Disposition header values
• Track libsoup library versions across your environment to identify vulnerable deployments

How to Mitigate CVE-2025-32913

Immediate Actions Required

• Identify all systems running applications that depend on libsoup
• Apply available security patches from your Linux distribution vendor immediately
• Consider temporarily disabling or restricting access to internet-facing services using vulnerable libsoup versions
• Monitor affected systems for signs of exploitation attempts

Patch Information

Multiple Linux distributions have released security updates to address this vulnerability. Consult the following vendor advisories for patch information:

• Red Hat Security Advisory RHSA-2025:4439
• Red Hat Security Advisory RHSA-2025:4440
• Red Hat Security Advisory RHSA-2025:4508
• Red Hat Security Advisory RHSA-2025:4538
• Red Hat Security Advisory RHSA-2025:4560
• Debian LTS Announcement

Additional details are available at the Red Hat CVE Analysis for CVE-2025-32913 and Red Hat Bugzilla Report #2359357.

Workarounds

• Restrict network access to vulnerable libsoup-based services using firewalls or network segmentation
• Implement a reverse proxy or WAF to filter malformed HTTP headers before they reach vulnerable applications
• If Content-Disposition parsing is not required, consider modifying application code to avoid calling the vulnerable function
• Deploy application sandboxing to limit the impact of crashes on overall system stability

# Example: Update libsoup on Red Hat-based systems
sudo dnf update libsoup --security

# Example: Update libsoup on Debian-based systems
sudo apt update && sudo apt install --only-upgrade libsoup2.4-1