CVE catalog

CVE-2025-32908

libsoup vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.61% · Oct 25, 2026

A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibsoup3sid3.8.0-3fixed
Debianlibsoup3forky3.8.0-3fixed
Debianlibsoup3trixie3.6.5-3fixed
Debianlibsoup3bookworm3.2.3-0+deb12u2vulnerable
Debianlibsoup2.4trixie2.74.3-10.1not affected
Debianlibsoup2.4bookworm2.74.3-1+deb12u1not affected
Ubuntulibsoup3nobleNot reportedvulnerable
Ubuntulibsoup2.4noble2.74.3-6ubuntu1.5fixed
Ubuntulibsoup3noble3.4.4-5ubuntu0.4fixed
Ubuntugir1.2-soup-2.4noble2.74.3-6ubuntu1.5fixed
Ubuntugir1.2-soup-3.0noble3.4.4-5ubuntu0.4fixed
Ubuntulibsoup-2.4-1noble2.74.3-6ubuntu1.5fixed
Ubuntulibsoup-3.0-0noble3.4.4-5ubuntu0.4fixed
Ubuntulibsoup-3.0-commonnoble3.4.4-5ubuntu0.4fixed
Ubuntulibsoup-3.0-devnoble3.4.4-5ubuntu0.4fixed
Ubuntulibsoup-3.0-docnoble3.4.4-5ubuntu0.4fixed
Ubuntulibsoup-3.0-testsnoble3.4.4-5ubuntu0.4fixed
Ubuntulibsoup-gnome-2.4-1noble2.74.3-6ubuntu1.5fixed
Ubuntulibsoup-gnome2.4-devnoble2.74.3-6ubuntu1.5fixed
Ubuntulibsoup2.4-commonnoble2.74.3-6ubuntu1.5fixed
Ubuntulibsoup2.4-devnoble2.74.3-6ubuntu1.5fixed
Ubuntulibsoup2.4-docnoble2.74.3-6ubuntu1.5fixed
Ubuntulibsoup2.4-testsnoble2.74.3-6ubuntu1.5fixed
Ubuntulibsoup2.4pro2.60.1-1vulnerable
Ubuntulibsoup2.4pro2.60.2-1vulnerable
Ubuntulibsoup2.4pro2.60.2-2vulnerable
Ubuntulibsoup2.4pro2.60.3-1vulnerable
Ubuntulibsoup2.4pro2.61.90-1vulnerable
Ubuntulibsoup2.4pro2.62.0-1vulnerable
Ubuntulibsoup2.4pro2.62.1-1vulnerable
Ubuntulibsoup2.4pro2.62.1-1ubuntu0.1vulnerable
Ubuntulibsoup2.4pro2.62.1-1ubuntu0.3vulnerable
Ubuntulibsoup2.4pro2.62.1-1ubuntu0.4vulnerable
Ubuntulibsoup2.4pro2.62.1-1ubuntu0.4+esm1vulnerable
Ubuntulibsoup2.4pro2.62.1-1ubuntu0.4+esm2vulnerable
Ubuntulibsoup2.4pro2.62.1-1ubuntu0.4+esm3vulnerable
Ubuntulibsoup2.4pro2.62.1-1ubuntu0.4+esm4fixed
Ubuntulibsoup2.420.042.68.2-0ubuntu1vulnerable
Ubuntulibsoup2.420.042.68.2-1vulnerable
Ubuntulibsoup2.420.042.68.2-2vulnerable
Ubuntulibsoup2.420.042.68.2-2build2vulnerable
Ubuntulibsoup2.420.042.69.90-1vulnerable
Ubuntulibsoup2.420.042.70.0-1vulnerable
Ubuntulibsoup2.420.042.70.0-1ubuntu0.1vulnerable
Ubuntulibsoup2.420.042.70.0-1ubuntu0.2vulnerable
Ubuntulibsoup2.420.042.70.0-1ubuntu0.3vulnerable
Ubuntulibsoup2.420.042.70.0-1ubuntu0.4vulnerable
Ubuntulibsoup2.420.042.70.0-1ubuntu0.5fixed
Ubuntulibsoup2.422.042.72.0-3ubuntu3vulnerable
Ubuntulibsoup2.422.042.74.1-1vulnerable
Ubuntulibsoup2.422.042.74.2-2vulnerable
Ubuntulibsoup2.422.042.74.2-3vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.1vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.2vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.3vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.4vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.5fixed
Ubuntulibsoup3pro3.0.4-2vulnerable
Ubuntulibsoup3pro3.0.4-3vulnerable
Ubuntulibsoup3pro3.0.5-1vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm1vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm2vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm3vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm4fixed
Ubuntulibsoup2.424.042.74.3-1vulnerable
Ubuntulibsoup2.424.042.74.3-2vulnerable
Ubuntulibsoup2.424.042.74.3-3vulnerable
Ubuntulibsoup2.424.042.74.3-6vulnerable
Ubuntulibsoup2.424.042.74.3-6build1vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.1vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.2vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.3vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.4vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.5fixed
Ubuntulibsoup324.043.4.2-4vulnerable
Ubuntulibsoup324.043.4.4-1vulnerable
Ubuntulibsoup324.043.4.4-2vulnerable
Ubuntulibsoup324.043.4.4-4vulnerable
Ubuntulibsoup324.043.4.4-5vulnerable
Ubuntulibsoup324.043.4.4-5build1vulnerable
Ubuntulibsoup324.043.4.4-5build2vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.1vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.2vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.3vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.4fixed
Ubuntulibsoup324.043.4.2-4vulnerable
Ubuntulibsoup324.043.4.4-1vulnerable
Ubuntulibsoup324.043.4.4-2vulnerable
Ubuntulibsoup324.043.4.4-4vulnerable
Ubuntulibsoup324.043.4.4-5vulnerable
Ubuntulibsoup324.043.4.4-5build1vulnerable
Ubuntulibsoup324.043.4.4-5build2vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.1vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.2vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.3vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.4fixed
Opensuselibsouptumbleweed3.6.5-2.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibsoup3sourcesid3.6.5-2not yet assignedNot reported[1103265]
Debianlibsoup3sourceforky3.6.5-2not yet assignedNot reported[1103265]
Debianlibsoup3sourcetrixie3.6.5-2not yet assignedNot reported[1103265]
Debianlibsoup3sourcebookworm(unfixed)not yet assignedNot reported[1103265]
Debianlibsoup2.4sourcetrixieNot affectedunimportantNot reportedNot reported
Debianlibsoup2.4sourcebookwormNot affectedunimportantNot reportedNot reported
Ubuntulibsoup2.4debnoble2.74.3-6ubuntu1.5Not reportedNot reportedNot reported
Ubuntulibsoup3debnoble3.4.4-5ubuntu0.4Not reportedNot reportedNot reported
Ubuntugir1.2-soup-2.4debnoble2.74.3-6ubuntu1.5Not reportedNot reportedNot reported
Ubuntugir1.2-soup-3.0debnoble3.4.4-5ubuntu0.4Not reportedNot reportedNot reported
Ubuntulibsoup-2.4-1debnoble2.74.3-6ubuntu1.5Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-0debnoble3.4.4-5ubuntu0.4Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-commondebnoble3.4.4-5ubuntu0.4Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-devdebnoble3.4.4-5ubuntu0.4Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-docdebnoble3.4.4-5ubuntu0.4Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-testsdebnoble3.4.4-5ubuntu0.4Not reportedNot reportedNot reported
Ubuntulibsoup-gnome-2.4-1debnoble2.74.3-6ubuntu1.5Not reportedNot reportedNot reported
Ubuntulibsoup-gnome2.4-devdebnoble2.74.3-6ubuntu1.5Not reportedNot reportedNot reported
Ubuntulibsoup2.4-commondebnoble2.74.3-6ubuntu1.5Not reportedNot reportedNot reported
Ubuntulibsoup2.4-devdebnoble2.74.3-6ubuntu1.5Not reportedNot reportedNot reported
Ubuntulibsoup2.4-docdebnoble2.74.3-6ubuntu1.5Not reportedNot reportedNot reported
Ubuntulibsoup2.4-testsdebnoble2.74.3-6ubuntu1.5Not reportedNot reportedNot reported
Ubuntulibsoup2.4debpro2.62.1-1ubuntu0.4+esm4Not reportedUSN-7543-1Not reported
Ubuntulibsoup2.4deb20.042.70.0-1ubuntu0.5Not reportedUSN-7543-1Not reported
Ubuntulibsoup2.4deb22.042.74.2-3ubuntu0.5Not reportedUSN-7543-1Not reported
Ubuntulibsoup3debpro3.0.7-0ubuntu1+esm4Not reportedUSN-7543-1Not reported
Ubuntulibsoup2.4deb24.042.74.3-6ubuntu1.5Not reportedUSN-7543-1Not reported
Ubuntulibsoup3deb24.043.4.4-5ubuntu0.4Not reportedUSN-7543-1Not reported
Ubuntulibsoup3deb24.043.4.4-5ubuntu0.4Not reportedUBUNTU-CVE-2025-32908Not reported
Opensuselibsouprpmtumbleweed3.6.5-2.1Not reportedOPENSUSE-SU-2025:15015-1Not reported

[Debian bug #1103265]

Notes

[bookworm] libsoup3: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [gir1.2-soup-3.0]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

  • [libsoup-3.0-0]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

  • [libsoup-3.0-common]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

  • [libsoup-3.0-dev]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

  • [libsoup-3.0-doc]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

  • [libsoup-3.0-tests]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

  • [gir1.2-soup-2.4]Not affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Not affected

      usn · libsoup2.4 · debian · bookworm

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Not affected

      usn · libsoup2.4 · debian · bookworm

  • [libsoup2.4-1]Not affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Not affected

      usn · libsoup2.4 · debian · bookworm

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Not affected

      usn · libsoup2.4 · debian · bookworm

  • [libsoup2.4-common]Not affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · all · bookworm

      Not affected

      usn · libsoup2.4 · debian · bookworm

    • 2.74.3-1+deb12u1 · all · bookworm

      Not affected

      usn · libsoup2.4 · debian · bookworm

  • [libsoup2.4-dev]Not affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Not affected

      usn · libsoup2.4 · debian · bookworm

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Not affected

      usn · libsoup2.4 · debian · bookworm

  • [libsoup2.4-doc]Not affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · all · bookworm

      Not affected

      usn · libsoup2.4 · debian · bookworm

    • 2.74.3-1+deb12u1 · all · bookworm

      Not affected

      usn · libsoup2.4 · debian · bookworm

  • [libsoup2.4-tests]Not affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Not affected

      usn · libsoup2.4 · debian · bookworm

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Not affected

      usn · libsoup2.4 · debian · bookworm

  • [libsoup-gnome2.4-1]Not affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Not affected

      usn · libsoup2.4 · debian · bookworm

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Not affected

      usn · libsoup2.4 · debian · bookworm

[openSUSE Tumbleweed]

  • [libsoup-3_0-0]Unknown

    Source package: [libsoup]

    Details (1)

    • 3.6.6-8.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.6.5-2.1

      Version impact unknown

      usn · libsoup · opensuse · tumbleweed

  • [libsoup-3_0-0-32bit]Unknown

    Source package: [libsoup]

    Details (1)

    • 3.6.6-8.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.6.5-2.1

      Version impact unknown

      usn · libsoup · opensuse · tumbleweed

  • [libsoup-devel]Unknown

    Source package: [libsoup]

    Details (1)

    • 3.6.6-8.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.6.5-2.1

      Version impact unknown

      usn · libsoup · opensuse · tumbleweed

  • [libsoup-devel-32bit]Unknown

    Source package: [libsoup]

    Details (1)

    • 3.6.6-8.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.6.5-2.1

      Version impact unknown

      usn · libsoup · opensuse · tumbleweed

  • [libsoup-lang]Unknown

    Source package: [libsoup]

    Details (1)

    • 3.6.6-8.1 · noarch · tumbleweed

      Unknown · Fixed: 3.6.5-2.1

      Version impact unknown

      usn · libsoup · opensuse · tumbleweed

  • [libsoup-tests]Unknown

    Source package: [libsoup]

    Details (1)

    • 3.6.6-8.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.6.5-2.1

      Version impact unknown

      usn · libsoup · opensuse · tumbleweed

  • [typelib-1_0-Soup-3_0]Unknown

    Source package: [libsoup]

    Details (1)

    • 3.6.6-8.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.6.5-2.1

      Version impact unknown

      usn · libsoup · opensuse · tumbleweed

Next results

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]