CVE catalog

CVE-2025-4948

libsoup vulnerabilities

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: May 19, 2025, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.81% · Oct 25, 2026

A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart messages. Due to improper validation, an internal calculation can go wrong, leading to an integer underflow. This can cause the program to access invalid memory and crash. As a result, any application or server using libsoup could be forced to exit unexpectedly, creating a denial-of-service (DoS) risk.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libsoup3	sid	`3.8.0-3`	fixed
Debian	libsoup3	forky	`3.8.0-3`	fixed
Debian	libsoup3	trixie	`3.6.5-3`	fixed
Debian	libsoup3	bookworm	`3.2.3-0+deb12u2`	vulnerable
Debian	libsoup2.4	trixie	`2.74.3-10.1`	vulnerable
Debian	libsoup2.4	bookworm	`2.74.3-1+deb12u1`	vulnerable
Ubuntu	libsoup2.4	noble	Not reported	vulnerable
Ubuntu	libsoup3	noble	Not reported	vulnerable
Ubuntu	libsoup2.4	noble	`2.74.3-6ubuntu1.6`	fixed
Ubuntu	libsoup3	noble	`3.4.4-5ubuntu0.5`	fixed
Ubuntu	gir1.2-soup-2.4	noble	`2.74.3-6ubuntu1.6`	fixed
Ubuntu	gir1.2-soup-3.0	noble	`3.4.4-5ubuntu0.5`	fixed
Ubuntu	libsoup-2.4-1	noble	`2.74.3-6ubuntu1.6`	fixed
Ubuntu	libsoup-3.0-0	noble	`3.4.4-5ubuntu0.5`	fixed
Ubuntu	libsoup-3.0-common	noble	`3.4.4-5ubuntu0.5`	fixed
Ubuntu	libsoup-3.0-dev	noble	`3.4.4-5ubuntu0.5`	fixed
Ubuntu	libsoup-3.0-doc	noble	`3.4.4-5ubuntu0.5`	fixed
Ubuntu	libsoup-3.0-tests	noble	`3.4.4-5ubuntu0.5`	fixed
Ubuntu	libsoup-gnome-2.4-1	noble	`2.74.3-6ubuntu1.6`	fixed
Ubuntu	libsoup-gnome2.4-dev	noble	`2.74.3-6ubuntu1.6`	fixed
Ubuntu	libsoup2.4-common	noble	`2.74.3-6ubuntu1.6`	fixed
Ubuntu	libsoup2.4-dev	noble	`2.74.3-6ubuntu1.6`	fixed
Ubuntu	libsoup2.4-doc	noble	`2.74.3-6ubuntu1.6`	fixed
Ubuntu	libsoup2.4-tests	noble	`2.74.3-6ubuntu1.6`	fixed
Ubuntu	libsoup2.4	pro	`2.68.2-0ubuntu1`	vulnerable
Ubuntu	libsoup2.4	pro	`2.68.2-1`	vulnerable
Ubuntu	libsoup2.4	pro	`2.68.2-2`	vulnerable
Ubuntu	libsoup2.4	pro	`2.68.2-2build2`	vulnerable
Ubuntu	libsoup2.4	pro	`2.69.90-1`	vulnerable
Ubuntu	libsoup2.4	pro	`2.70.0-1`	vulnerable
Ubuntu	libsoup2.4	pro	`2.70.0-1ubuntu0.1`	vulnerable
Ubuntu	libsoup2.4	pro	`2.70.0-1ubuntu0.2`	vulnerable
Ubuntu	libsoup2.4	pro	`2.70.0-1ubuntu0.3`	vulnerable
Ubuntu	libsoup2.4	pro	`2.70.0-1ubuntu0.4`	vulnerable
Ubuntu	libsoup2.4	pro	`2.70.0-1ubuntu0.5`	vulnerable
Ubuntu	libsoup2.4	pro	`2.70.0-1ubuntu0.5+esm1`	fixed
Ubuntu	libsoup2.4	22.04	`2.72.0-3ubuntu3`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.1-1`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-2`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.1`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.2`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.3`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.4`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.5`	vulnerable
Ubuntu	libsoup2.4	22.04	`2.74.2-3ubuntu0.6`	fixed
Ubuntu	libsoup3	pro	`3.0.4-2`	vulnerable
Ubuntu	libsoup3	pro	`3.0.4-3`	vulnerable
Ubuntu	libsoup3	pro	`3.0.5-1`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm1`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm2`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm3`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm4`	vulnerable
Ubuntu	libsoup3	pro	`3.0.7-0ubuntu1+esm5`	fixed
Ubuntu	libsoup2.4	24.04	`2.74.3-1`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-2`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-3`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6build1`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.1`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.2`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.3`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.4`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.5`	vulnerable
Ubuntu	libsoup2.4	24.04	`2.74.3-6ubuntu1.6`	fixed
Ubuntu	libsoup3	24.04	`3.4.2-4`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-1`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-2`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-4`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5build1`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5build2`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.1`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.2`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.3`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.4`	vulnerable
Ubuntu	libsoup3	24.04	`3.4.4-5ubuntu0.5`	fixed
Ubuntu	libsoup2.4	25.10	`2.74.3-10`	vulnerable
Ubuntu	libsoup2.4	25.10	`2.74.3-10.1`	vulnerable
Ubuntu	libsoup2.4	25.10	`2.74.3-10.1ubuntu1`	vulnerable
Ubuntu	libsoup2.4	25.10	`2.74.3-10.1ubuntu2`	vulnerable
Ubuntu	libsoup2.4	25.10	`2.74.3-10.1ubuntu3`	vulnerable
Ubuntu	libsoup2.4	25.10	`2.74.3-10.1ubuntu4`	fixed
Ubuntu	libsoup3	25.10	`3.6.5-1`	vulnerable
Ubuntu	libsoup3	25.10	`3.6.5-1ubuntu1`	vulnerable
Ubuntu	libsoup3	25.10	`3.6.5-3`	fixed
Ubuntu	libsoup2.4	26.04	`2.74.3-10.1ubuntu4`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libsoup3	source	sid	`3.6.5-2`	not yet assigned	Not reported	[1106204]
Debian	libsoup3	source	forky	`3.6.5-2`	not yet assigned	Not reported	[1106204]
Debian	libsoup3	source	trixie	`3.6.5-2`	not yet assigned	Not reported	[1106204]
Debian	libsoup3	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1106204]
Debian	libsoup2.4	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1106337]
Debian	libsoup2.4	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1106337]
Ubuntu	libsoup2.4	deb	noble	`2.74.3-6ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	libsoup3	deb	noble	`3.4.4-5ubuntu0.5`	Not reported	Not reported	Not reported
Ubuntu	gir1.2-soup-2.4	deb	noble	`2.74.3-6ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	gir1.2-soup-3.0	deb	noble	`3.4.4-5ubuntu0.5`	Not reported	Not reported	Not reported
Ubuntu	libsoup-2.4-1	deb	noble	`2.74.3-6ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	libsoup-3.0-0	deb	noble	`3.4.4-5ubuntu0.5`	Not reported	Not reported	Not reported
Ubuntu	libsoup-3.0-common	deb	noble	`3.4.4-5ubuntu0.5`	Not reported	Not reported	Not reported
Ubuntu	libsoup-3.0-dev	deb	noble	`3.4.4-5ubuntu0.5`	Not reported	Not reported	Not reported
Ubuntu	libsoup-3.0-doc	deb	noble	`3.4.4-5ubuntu0.5`	Not reported	Not reported	Not reported
Ubuntu	libsoup-3.0-tests	deb	noble	`3.4.4-5ubuntu0.5`	Not reported	Not reported	Not reported
Ubuntu	libsoup-gnome-2.4-1	deb	noble	`2.74.3-6ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	libsoup-gnome2.4-dev	deb	noble	`2.74.3-6ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	libsoup2.4-common	deb	noble	`2.74.3-6ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	libsoup2.4-dev	deb	noble	`2.74.3-6ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	libsoup2.4-doc	deb	noble	`2.74.3-6ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	libsoup2.4-tests	deb	noble	`2.74.3-6ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	libsoup2.4	deb	pro	`2.70.0-1ubuntu0.5+esm1`	Not reported	UBUNTU-CVE-2025-4948	Not reported
Ubuntu	libsoup2.4	deb	22.04	`2.74.2-3ubuntu0.6`	Not reported	UBUNTU-CVE-2025-4948	Not reported
Ubuntu	libsoup3	deb	pro	`3.0.7-0ubuntu1+esm5`	Not reported	UBUNTU-CVE-2025-4948	Not reported
Ubuntu	libsoup2.4	deb	24.04	`2.74.3-6ubuntu1.6`	Not reported	UBUNTU-CVE-2025-4948	Not reported
Ubuntu	libsoup3	deb	24.04	`3.4.4-5ubuntu0.5`	Not reported	UBUNTU-CVE-2025-4948	Not reported
Ubuntu	libsoup2.4	deb	25.10	`2.74.3-10.1ubuntu4`	Not reported	UBUNTU-CVE-2025-4948	Not reported
Ubuntu	libsoup3	deb	25.10	`3.6.5-3`	Not reported	UBUNTU-CVE-2025-4948	Not reported
Ubuntu	libsoup2.4	deb	26.04	`2.74.3-10.1ubuntu4`	Not reported	UBUNTU-CVE-2025-4948	Not reported

[Debian bug #1106204][Debian bug #1106337]

Notes

[bookworm] libsoup3: Minor issue [trixie] libsoup2.4: Minor issue [bookworm] libsoup2.4: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[gir1.2-soup-2.4]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
[gir1.2-soup-3.0]Affected
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · amd64 · bookworm
  Affected
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · arm64 · bookworm
  Affected
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
[libsoup2.4-1]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
[libsoup2.4-common]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · all · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · all · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
[libsoup2.4-dev]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
[libsoup2.4-doc]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · all · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · all · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
[libsoup2.4-tests]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
[libsoup-3.0-0]Affected
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · amd64 · bookworm
  Affected
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · arm64 · bookworm
  Affected
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
[libsoup-3.0-common]Affected
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · all · bookworm
  Affected
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · all · bookworm
  Affected
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
[libsoup-3.0-dev]Affected
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · amd64 · bookworm
  Affected
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · arm64 · bookworm
  Affected
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
[libsoup-3.0-doc]Affected
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · all · bookworm
  Affected
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · all · bookworm
  Affected
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
[libsoup-3.0-tests]Affected
Source package: [libsoup3]
Details (2)
- 3.2.3-0+deb12u2 · amd64 · bookworm
  Affected
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
- 3.2.3-0+deb12u2 · arm64 · bookworm
  Affected
  usn · libsoup3 · debian · bookworm; usn · libsoup3 · debian · 12
[libsoup-gnome2.4-1]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
[libsoup-gnome2.4-dev]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-1+deb12u1 · amd64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12
- 2.74.3-1+deb12u1 · arm64 · bookworm
  Affected
  usn · libsoup2.4 · debian · bookworm; usn · libsoup2.4 · debian · 12

[Debian 13 (Trixie)]

[gir1.2-soup-2.4]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · amd64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13
- 2.74.3-10.1 · arm64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13
[libsoup-2.4-1]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · amd64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13
- 2.74.3-10.1 · arm64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13
[libsoup2.4-common]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · all · trixie
  Affected
  usn · libsoup2.4 · debian · 13
- 2.74.3-10.1 · all · trixie
  Affected
  usn · libsoup2.4 · debian · 13
[libsoup2.4-dev]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · amd64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13
- 2.74.3-10.1 · arm64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13
[libsoup2.4-doc]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · all · trixie
  Affected
  usn · libsoup2.4 · debian · 13
- 2.74.3-10.1 · all · trixie
  Affected
  usn · libsoup2.4 · debian · 13
[libsoup2.4-tests]Affected
Source package: [libsoup2.4]
Details (2)
- 2.74.3-10.1 · amd64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13
- 2.74.3-10.1 · arm64 · trixie
  Affected
  usn · libsoup2.4 · debian · 13

Next results

Observed: Oct 24, 2026, 10:21:40 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]