CVE catalog

CVE-2025-4945

libsoup vulnerabilities

[CVE catalog]

Severity
Low · CVSS 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.70% · Oct 25, 2026

A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior. The issue stems from improper validation of large integer inputs during date arithmetic operations within the cookie parsing routines.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibsoup3sid3.8.0-3fixed
Debianlibsoup3forky3.8.0-3fixed
Debianlibsoup3trixie3.6.5-3fixed
Debianlibsoup3bookworm3.2.3-0+deb12u2vulnerable
Debianlibsoup2.4trixie2.74.3-10.1vulnerable
Debianlibsoup2.4bookworm2.74.3-1+deb12u1vulnerable
Ubuntulibsoup2.4nobleNot reportedvulnerable
Ubuntulibsoup3nobleNot reportedvulnerable
Ubuntulibsoup2.4noble2.74.3-6ubuntu1.6fixed
Ubuntulibsoup3noble3.4.4-5ubuntu0.5fixed
Ubuntugir1.2-soup-2.4noble2.74.3-6ubuntu1.6fixed
Ubuntugir1.2-soup-3.0noble3.4.4-5ubuntu0.5fixed
Ubuntulibsoup-2.4-1noble2.74.3-6ubuntu1.6fixed
Ubuntulibsoup-3.0-0noble3.4.4-5ubuntu0.5fixed
Ubuntulibsoup-3.0-commonnoble3.4.4-5ubuntu0.5fixed
Ubuntulibsoup-3.0-devnoble3.4.4-5ubuntu0.5fixed
Ubuntulibsoup-3.0-docnoble3.4.4-5ubuntu0.5fixed
Ubuntulibsoup-3.0-testsnoble3.4.4-5ubuntu0.5fixed
Ubuntulibsoup-gnome-2.4-1noble2.74.3-6ubuntu1.6fixed
Ubuntulibsoup-gnome2.4-devnoble2.74.3-6ubuntu1.6fixed
Ubuntulibsoup2.4-commonnoble2.74.3-6ubuntu1.6fixed
Ubuntulibsoup2.4-devnoble2.74.3-6ubuntu1.6fixed
Ubuntulibsoup2.4-docnoble2.74.3-6ubuntu1.6fixed
Ubuntulibsoup2.4-testsnoble2.74.3-6ubuntu1.6fixed
Ubuntulibsoup2.4pro2.68.2-0ubuntu1vulnerable
Ubuntulibsoup2.4pro2.68.2-1vulnerable
Ubuntulibsoup2.4pro2.68.2-2vulnerable
Ubuntulibsoup2.4pro2.68.2-2build2vulnerable
Ubuntulibsoup2.4pro2.69.90-1vulnerable
Ubuntulibsoup2.4pro2.70.0-1vulnerable
Ubuntulibsoup2.4pro2.70.0-1ubuntu0.1vulnerable
Ubuntulibsoup2.4pro2.70.0-1ubuntu0.2vulnerable
Ubuntulibsoup2.4pro2.70.0-1ubuntu0.3vulnerable
Ubuntulibsoup2.4pro2.70.0-1ubuntu0.4vulnerable
Ubuntulibsoup2.4pro2.70.0-1ubuntu0.5vulnerable
Ubuntulibsoup2.4pro2.70.0-1ubuntu0.5+esm1fixed
Ubuntulibsoup2.422.042.72.0-3ubuntu3vulnerable
Ubuntulibsoup2.422.042.74.1-1vulnerable
Ubuntulibsoup2.422.042.74.2-2vulnerable
Ubuntulibsoup2.422.042.74.2-3vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.1vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.2vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.3vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.4vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.5vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.6fixed
Ubuntulibsoup3pro3.0.4-2vulnerable
Ubuntulibsoup3pro3.0.4-3vulnerable
Ubuntulibsoup3pro3.0.5-1vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm1vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm2vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm3vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm4vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm5fixed
Ubuntulibsoup2.424.042.74.3-1vulnerable
Ubuntulibsoup2.424.042.74.3-2vulnerable
Ubuntulibsoup2.424.042.74.3-3vulnerable
Ubuntulibsoup2.424.042.74.3-6vulnerable
Ubuntulibsoup2.424.042.74.3-6build1vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.1vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.2vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.3vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.4vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.5vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.6fixed
Ubuntulibsoup324.043.4.2-4vulnerable
Ubuntulibsoup324.043.4.4-1vulnerable
Ubuntulibsoup324.043.4.4-2vulnerable
Ubuntulibsoup324.043.4.4-4vulnerable
Ubuntulibsoup324.043.4.4-5vulnerable
Ubuntulibsoup324.043.4.4-5build1vulnerable
Ubuntulibsoup324.043.4.4-5build2vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.1vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.2vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.3vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.4vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.5fixed
Ubuntulibsoup2.425.102.74.3-10vulnerable
Ubuntulibsoup2.425.102.74.3-10.1vulnerable
Ubuntulibsoup2.425.102.74.3-10.1ubuntu1vulnerable
Ubuntulibsoup2.425.102.74.3-10.1ubuntu2vulnerable
Ubuntulibsoup2.425.102.74.3-10.1ubuntu3vulnerable
Ubuntulibsoup2.425.102.74.3-10.1ubuntu4fixed
Ubuntulibsoup325.103.6.5-1vulnerable
Ubuntulibsoup325.103.6.5-1ubuntu1vulnerable
Ubuntulibsoup325.103.6.5-3fixed
Ubuntulibsoup2.426.042.74.3-10.1ubuntu4fixed
Opensuselibsouptumbleweed3.6.5-6.1fixed
Opensuselibsoup2tumbleweed2.74.3-12.1fixed
Suselibsoup2linux enterprise micro 5.32.74.2-150400.3.12.1fixed
Suselibsoup2linux enterprise micro 5.42.74.2-150400.3.12.1fixed
Suselibsoup2linux enterprise micro 5.52.74.2-150400.3.12.1fixed
Suselibsouplinux enterprise module for basesystem 15 sp63.4.4-150600.3.13.1fixed
Suselibsouplinux enterprise module for basesystem 15 sp73.4.4-150600.3.13.1fixed
Opensuselibsoupleap 15.63.4.4-150600.3.13.1fixed
Suselibsoup2linux enterprise module for basesystem 15 sp62.74.3-150600.4.12.1fixed
Suselibsoup2linux enterprise module for basesystem 15 sp72.74.3-150600.4.12.1fixed
Opensuselibsoup2leap 15.62.74.3-150600.4.12.1fixed
Suselibsouplinux enterprise server ltss extended security 12 sp52.62.2-5.18.1fixed
Suselibsouplinux enterprise micro 5.22.68.4-150200.4.12.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibsoup3sourcesid3.6.5-2not yet assignedNot reported[1106205]
Debianlibsoup3sourceforky3.6.5-2not yet assignedNot reported[1106205]
Debianlibsoup3sourcetrixie3.6.5-2not yet assignedNot reported[1106205]
Debianlibsoup3sourcebookworm(unfixed)not yet assignedNot reported[1106205]
Debianlibsoup2.4sourcetrixie(unfixed)not yet assignedNot reported[1106375]
Debianlibsoup2.4sourcebookworm(unfixed)not yet assignedNot reported[1106375]
Ubuntulibsoup2.4debnoble2.74.3-6ubuntu1.6Not reportedNot reportedNot reported
Ubuntulibsoup3debnoble3.4.4-5ubuntu0.5Not reportedNot reportedNot reported
Ubuntugir1.2-soup-2.4debnoble2.74.3-6ubuntu1.6Not reportedNot reportedNot reported
Ubuntugir1.2-soup-3.0debnoble3.4.4-5ubuntu0.5Not reportedNot reportedNot reported
Ubuntulibsoup-2.4-1debnoble2.74.3-6ubuntu1.6Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-0debnoble3.4.4-5ubuntu0.5Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-commondebnoble3.4.4-5ubuntu0.5Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-devdebnoble3.4.4-5ubuntu0.5Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-docdebnoble3.4.4-5ubuntu0.5Not reportedNot reportedNot reported
Ubuntulibsoup-3.0-testsdebnoble3.4.4-5ubuntu0.5Not reportedNot reportedNot reported
Ubuntulibsoup-gnome-2.4-1debnoble2.74.3-6ubuntu1.6Not reportedNot reportedNot reported
Ubuntulibsoup-gnome2.4-devdebnoble2.74.3-6ubuntu1.6Not reportedNot reportedNot reported
Ubuntulibsoup2.4-commondebnoble2.74.3-6ubuntu1.6Not reportedNot reportedNot reported
Ubuntulibsoup2.4-devdebnoble2.74.3-6ubuntu1.6Not reportedNot reportedNot reported
Ubuntulibsoup2.4-docdebnoble2.74.3-6ubuntu1.6Not reportedNot reportedNot reported
Ubuntulibsoup2.4-testsdebnoble2.74.3-6ubuntu1.6Not reportedNot reportedNot reported
Ubuntulibsoup2.4debpro2.70.0-1ubuntu0.5+esm1Not reportedUBUNTU-CVE-2025-4945Not reported
Ubuntulibsoup2.4deb22.042.74.2-3ubuntu0.6Not reportedUBUNTU-CVE-2025-4945Not reported
Ubuntulibsoup3debpro3.0.7-0ubuntu1+esm5Not reportedUBUNTU-CVE-2025-4945Not reported
Ubuntulibsoup2.4deb24.042.74.3-6ubuntu1.6Not reportedUBUNTU-CVE-2025-4945Not reported
Ubuntulibsoup3deb24.043.4.4-5ubuntu0.5Not reportedUBUNTU-CVE-2025-4945Not reported
Ubuntulibsoup2.4deb25.102.74.3-10.1ubuntu4Not reportedUBUNTU-CVE-2025-4945Not reported
Ubuntulibsoup3deb25.103.6.5-3Not reportedUBUNTU-CVE-2025-4945Not reported
Ubuntulibsoup2.4deb26.042.74.3-10.1ubuntu4Not reportedUBUNTU-CVE-2025-4945Not reported
Opensuselibsouprpmtumbleweed3.6.5-6.1Not reportedOPENSUSE-SU-2025:15241-1Not reported
Opensuselibsoup2rpmtumbleweed2.74.3-12.1Not reportedOPENSUSE-SU-2025:15242-1Not reported
Suselibsoup2rpmlinux enterprise micro 5.32.74.2-150400.3.12.1Not reportedSUSE-SU-2025:03091-1Not reported
Suselibsoup2rpmlinux enterprise micro 5.42.74.2-150400.3.12.1Not reportedSUSE-SU-2025:03091-1Not reported
Suselibsoup2rpmlinux enterprise micro 5.52.74.2-150400.3.12.1Not reportedSUSE-SU-2025:03091-1Not reported
Suselibsouprpmlinux enterprise module for basesystem 15 sp63.4.4-150600.3.13.1Not reportedSUSE-SU-2025:02276-1Not reported
Suselibsouprpmlinux enterprise module for basesystem 15 sp73.4.4-150600.3.13.1Not reportedSUSE-SU-2025:02276-1Not reported
Opensuselibsouprpmleap 15.63.4.4-150600.3.13.1Not reportedSUSE-SU-2025:02276-1Not reported
Suselibsoup2rpmlinux enterprise module for basesystem 15 sp62.74.3-150600.4.12.1Not reportedSUSE-SU-2025:02277-1Not reported
Suselibsoup2rpmlinux enterprise module for basesystem 15 sp72.74.3-150600.4.12.1Not reportedSUSE-SU-2025:02277-1Not reported
Opensuselibsoup2rpmleap 15.62.74.3-150600.4.12.1Not reportedSUSE-SU-2025:02277-1Not reported
Suselibsouprpmlinux enterprise server ltss extended security 12 sp52.62.2-5.18.1Not reportedSUSE-SU-2025:03026-1Not reported
Suselibsouprpmlinux enterprise micro 5.22.68.4-150200.4.12.1Not reportedSUSE-SU-2025:02212-1Not reported

[Debian bug #1106205][Debian bug #1106375]

Notes

[bookworm] libsoup3: Minor issue [trixie] libsoup2.4: Minor issue [bookworm] libsoup2.4: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [gir1.2-soup-2.4]Affected

    Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

  • [gir1.2-soup-3.0]Affected

    Source package: [libsoup3]

    Details (2)
    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

  • [libsoup2.4-1]Affected

    Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

  • Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

  • [libsoup2.4-dev]Affected

    Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

  • [libsoup2.4-doc]Affected

    Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

  • Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

  • [libsoup-3.0-0]Affected

    Source package: [libsoup3]

    Details (2)
    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

  • Source package: [libsoup3]

    Details (2)
    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

  • [libsoup-3.0-dev]Affected

    Source package: [libsoup3]

    Details (2)
    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

  • [libsoup-3.0-doc]Affected

    Source package: [libsoup3]

    Details (2)
    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

  • Source package: [libsoup3]

    Details (2)
    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12

  • Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

  • Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

[Debian 13 (Trixie)]

  • [gir1.2-soup-2.4]Affected

    Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-10.1 · amd64 · trixie

      Affected

      usn · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      usn · libsoup2.4 · debian · 13

  • [libsoup-2.4-1]Affected

    Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-10.1 · amd64 · trixie

      Affected

      usn · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      usn · libsoup2.4 · debian · 13

  • Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-10.1 · all · trixie

      Affected

      usn · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · all · trixie

      Affected

      usn · libsoup2.4 · debian · 13

  • [libsoup2.4-dev]Affected

    Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-10.1 · amd64 · trixie

      Affected

      usn · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      usn · libsoup2.4 · debian · 13

  • [libsoup2.4-doc]Affected

    Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-10.1 · all · trixie

      Affected

      usn · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · all · trixie

      Affected

      usn · libsoup2.4 · debian · 13

  • Source package: [libsoup2.4]

    Details (2)
    • 2.74.3-10.1 · amd64 · trixie

      Affected

      usn · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      usn · libsoup2.4 · debian · 13

Next results

Observed:

References