CVE-2025-4948: libsoup HTTP Library DoS Vulnerability

CVE-2025-4948 Overview

A critical integer underflow vulnerability has been identified in the soup_multipart_new_from_message() function of the libsoup HTTP library. Libsoup is widely used by GNOME and other applications to handle web communications, making this vulnerability particularly impactful across Linux desktop environments and server applications.

The flaw occurs when libsoup processes specially crafted multipart messages. Due to improper validation during internal calculations, an integer underflow condition can be triggered, causing the program to access invalid memory regions and crash. This vulnerability enables attackers to force any application or server using libsoup to exit unexpectedly, creating a significant denial-of-service (DoS) risk.

Critical Impact

Remote attackers can crash applications and services using libsoup by sending malicious multipart HTTP messages, causing widespread service disruption without authentication.

Affected Products

• GNOME libsoup library
• Red Hat Enterprise Linux (multiple versions)
• Applications using libsoup for HTTP communications

Discovery Timeline

• May 19, 2025 - CVE-2025-4948 published to NVD
• November 18, 2025 - Last updated in NVD database

Technical Details for CVE-2025-4948

Vulnerability Analysis

This vulnerability is classified as CWE-191 (Integer Underflow). The flaw resides in the soup_multipart_new_from_message() function, which is responsible for parsing multipart HTTP messages. When processing boundary delimiters in multipart content, the function performs arithmetic operations on length values derived from user-controlled input.

The integer underflow occurs when the function attempts to calculate buffer boundaries or offset values. If a malicious multipart message is crafted with specific boundary parameters, the calculation can produce a negative value that wraps around to a very large positive integer due to unsigned integer representation. This causes subsequent memory operations to access invalid memory regions, leading to a crash.

The vulnerability is network-accessible and requires no authentication or user interaction, making it particularly dangerous for services exposed to the internet.

Root Cause

The root cause is insufficient validation of input parameters before performing arithmetic operations in the multipart message parsing logic. Specifically, the soup_multipart_new_from_message() function does not properly validate that calculated values remain within expected bounds before using them for memory operations. This oversight allows carefully crafted input to trigger an integer underflow condition.

Attack Vector

An attacker can exploit this vulnerability by sending a specially crafted HTTP multipart message to any application or service that uses libsoup for processing HTTP communications. The attack requires:

1. Network access to a target application using libsoup
2. The ability to send crafted multipart HTTP requests
3. No authentication or special privileges

The vulnerability manifests in the multipart message boundary handling logic. When the library processes the malicious message, the integer underflow causes invalid memory access, resulting in application termination. For detailed technical analysis, refer to the GNOME Issue Tracker for libsoup #449 and the Red Hat CVE Analysis.

Detection Methods for CVE-2025-4948

Indicators of Compromise

• Unexpected crashes or restarts of applications using libsoup (e.g., GNOME applications, web clients)
• Segmentation fault errors in system logs related to libsoup or dependent applications
• Abnormal HTTP traffic patterns with malformed multipart Content-Type headers
• Core dump files indicating memory access violations in libsoup functions

Detection Strategies

• Monitor application crash logs for segmentation faults originating from libsoup shared libraries
• Implement network intrusion detection rules to identify malformed multipart HTTP requests with unusual boundary parameters
• Configure application-level monitoring to detect repeated crashes of libsoup-dependent services
• Use memory debugging tools (e.g., AddressSanitizer) during development to detect integer underflow conditions

Monitoring Recommendations

• Enable crash reporting and centralized logging for all applications using libsoup
• Monitor system stability metrics for GNOME desktop environments and web-facing services
• Set up alerts for unusual patterns of service restarts or application failures
• Review HTTP access logs for requests with suspicious multipart content characteristics

How to Mitigate CVE-2025-4948

Immediate Actions Required

• Update libsoup to the latest patched version from your distribution's package repository
• Apply Red Hat security advisories if running RHEL-based systems
• Implement network-level filtering to block malformed multipart HTTP requests if possible
• Consider temporarily restricting network access to affected services until patches are applied

Patch Information

Multiple security advisories have been released to address this vulnerability:

• Red Hat Security Advisory RHSA-2025:8126
• Red Hat Security Advisory RHSA-2025:8128
• Red Hat Security Advisory RHSA-2025:8132
• Red Hat Security Advisory RHSA-2025:8139
• Red Hat Security Advisory RHSA-2025:8140
• Red Hat Security Advisory RHSA-2025:8252
• Red Hat Security Advisory RHSA-2025:8480
• Red Hat Security Advisory RHSA-2025:21657

Additional details are available in Red Hat Bugzilla Entry #2367183.

Workarounds

• Deploy a web application firewall (WAF) to inspect and filter malformed multipart HTTP requests before they reach vulnerable applications
• Implement rate limiting on endpoints that process multipart content to reduce the impact of potential DoS attacks
• If libsoup is not required for specific applications, consider using alternative HTTP libraries temporarily
• Isolate affected services in network segments with restricted access until patching is complete

# Update libsoup on RHEL/CentOS/Fedora systems
sudo dnf update libsoup --refresh

# Verify installed version after update
rpm -qa | grep libsoup

# Restart affected services after patching
sudo systemctl restart gdm
sudo systemctl restart gnome-shell