CVE-2025-46420: libsoup Memory Leak Vulnerability

CVE-2025-46420 Overview

CVE-2025-46420 is a memory leak vulnerability in libsoup, the HTTP client/server library used by GNOME applications and many Linux services. The flaw resides in the soup_header_parse_quality_list() function, which fails to release allocated memory when parsing quality lists containing entries with all-zero values. Attackers can trigger repeated allocations by sending crafted HTTP headers, gradually exhausting memory in long-running processes. The issue is tracked as [CWE-401] Missing Release of Memory After Effective Lifetime. Red Hat has issued multiple advisories covering affected Red Hat Enterprise Linux packages.

Critical Impact
Remote attackers can cause denial of service through progressive memory exhaustion in applications parsing untrusted HTTP quality-value headers via libsoup.

Affected Products

GNOME libsoup HTTP library
Red Hat Enterprise Linux (multiple versions, per RHSA-2025:4439 through RHSA-2025:7436)
Applications and services linking against vulnerable libsoup builds

Discovery Timeline

2025-04-24 - CVE-2025-46420 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2025-46420

Vulnerability Analysis

The vulnerability lives in soup_header_parse_quality_list(), a helper that parses HTTP headers using quality values such as Accept, Accept-Language, and Accept-Encoding. These headers follow the RFC 7231 q= syntax, where each list element may carry a quality factor between 0 and 1. When a client or server processes a list where every element has a quality factor of zero, libsoup allocates auxiliary structures but does not free them along the affected code path. Each malformed request leaks a small amount of heap memory. Because HTTP header parsing occurs on every request, sustained traffic amplifies the leak into a denial-of-service condition. The impact metrics reflect the availability-only nature of the flaw: no data is disclosed or modified, but the target process can be driven to memory exhaustion and eventual termination.

Root Cause

The root cause is a missing deallocation branch in the quality-list parsing logic. When all parsed entries evaluate to zero quality, they are excluded from the returned unacceptable list but the intermediate allocations remain referenced by unreachable pointers. See GNOME Issue #438 and Red Hat Bug Report #2361963 for the maintainer discussion.

Attack Vector

Exploitation requires user interaction, typically causing a client to fetch attacker-controlled content or causing a server to process crafted request headers. An attacker can supply a quality list such as en;q=0, fr;q=0, de;q=0 in an Accept-Language header. Repeated submission of such requests, or automated retrieval loops on client applications, incrementally consume memory. No authentication is required and complexity is low. The vulnerability produces no code execution or information disclosure; the terminal outcome is process crash or host instability.

No verified public exploit code exists. Refer to the Red Hat CVE Report CVE-2025-46420 for vendor analysis.

Detection Methods for CVE-2025-46420

Indicators of Compromise

Steady, unbounded growth of resident memory in processes linking libsoup such as gnome-shell, evolution, or custom HTTP clients.
HTTP request logs showing repeated Accept, Accept-Language, or Accept-Encoding headers where every element carries q=0.
Out-of-memory (OOM) killer events terminating libsoup-based services under otherwise normal load.

Detection Strategies

Deploy vulnerability scanners with feeds tracking Red Hat advisories RHSA-2025:4439 through RHSA-2025:7436 to identify unpatched libsoup packages.
Instrument long-running libsoup consumers with heap profiling tools such as valgrind --tool=massif or heaptrack during triage.
Correlate application memory metrics with inbound HTTP header patterns in your web application firewall or reverse proxy logs.

Monitoring Recommendations

Alert on process RSS (resident set size) growth exceeding baseline for services that parse third-party HTTP headers.
Track OOM-kill and cgroup memory pressure events on hosts running GNOME desktops or libsoup-dependent daemons.
Log and rate-limit HTTP requests carrying malformed or entirely zero-weighted quality lists at the edge.

How to Mitigate CVE-2025-46420

Immediate Actions Required

Apply the patched libsoup packages from your Linux distribution; Red Hat customers should install updates referenced in RHSA-2025:4439 and later advisories.
Restart all services and desktop sessions that dynamically link libsoup so the fixed library is loaded.
Inventory containers, appliances, and embedded systems that ship libsoup and prioritize rebuilds with the patched version.

Patch Information

Red Hat has published patches across multiple product streams, including RHSA-2025:4440, RHSA-2025:4508, RHSA-2025:4538, RHSA-2025:4560, RHSA-2025:4568, RHSA-2025:4609, RHSA-2025:4624, and RHSA-2025:7436. The upstream fix is tracked in GNOME Issue #438.

Workarounds

Filter or normalize HTTP quality-value headers at a reverse proxy, rejecting lists where every element is q=0.
Apply cgroup memory limits or systemd MemoryMax= directives to constrain libsoup-based services and force restart on runaway growth.
Restrict libsoup-based clients from automatically fetching untrusted URLs where feasible until patches are deployed.

bash

# Configuration example: patch libsoup on Red Hat Enterprise Linux
sudo dnf update libsoup libsoup3 --refresh
sudo dnf update --advisory=RHSA-2025:4439
rpm -q libsoup libsoup3
sudo systemctl restart <libsoup-dependent-service>