Untriaged
Permalink
CVE-2025-32907
7.5 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): NONE
- Availability impact (A): HIGH
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse removed package tests.pkg-config.defaultPkgConfigPackages."libsoup-gnome-2.4"
- @LeSuisse removed package libsoup_3
Libsoup: denial of service in server when client requests a large amount of overlapping ranges with range header
A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory.
References
Affected products
libsoup
- *
- <3.6.5
libsoup3
- *
mingw-freetype
- *
spice-client-win
- *
Matching in nixpkgs
pkgs.libsoup_2_4
HTTP client/server library for GNOME
-
nixos-unstable -
- nixpkgs-unstable 2.74.3
Package maintainers
-
@jtojnar Jan Tojnar <jtojnar@gmail.com>
-
@hedning Tor Hedin Brønner <torhedinbronner@gmail.com>
-
@dasj19 Daniel Șerbănescu <daniel@serbanescu.dk>
-
@7c6f434c Michael Raskin <7c6f434c@mail.ru>
-
@lovek323 Jason O'Conal <jason@oconal.id.au>
-
@bobby285271 Bobby Rong <rjl931189261@126.com>