CVE-2025-4948

HIGH

libsoup - Memory Corruption

Title source: llm
STIX 2.1

Description

A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart messages. Due to improper validation, an internal calculation can go wrong, leading to an integer underflow. This can cause the program to access invalid memory and crash. As a result, any application or server using libsoup could be forced to exit unexpectedly, creating a denial-of-service (DoS) risk.

References (15)

Core 15
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:21657
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:8126
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:8128
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:8132
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:8139
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:8140
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:8252
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:8480
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:8481
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:8482
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:8663
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:9179
Vendor Advisory vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2025-4948
Issue Tracking issue-tracking x_refsource_redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2367183

Scores

CVSS v3 7.5
EPSS 0.0063
EPSS Percentile 45.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-191
Status published
Products (15)
Red Hat/Red Hat Enterprise Linux 10 0:3.6.5-3.el10_0.6
Red Hat/Red Hat Enterprise Linux 6
Red Hat/Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:2.62.2-6.el7_9
Red Hat/Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:2.62.2-9.el7_9
Red Hat/Red Hat Enterprise Linux 8 0:2.62.3-9.el8_10
Red Hat/Red Hat Enterprise Linux 8.2 Advanced Update Support 0:2.62.3-1.el8_2.5
Red Hat/Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:2.62.3-2.el8_4.5
Red Hat/Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:2.62.3-2.el8_6.5
Red Hat/Red Hat Enterprise Linux 8.6 Telecommunications Update Service 0:2.62.3-2.el8_6.5
Red Hat/Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 0:2.62.3-2.el8_6.5
... and 5 more
Published May 19, 2025
Tracked Since Feb 18, 2026