Libsoup: out of bounds reads in soup_headers_parse_request()

Summary

A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server.

Timeline

1. Apr 14, 2025, 1:58 PM UTCCVE published
2. Apr 14, 2025, 2:13 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Jun 29, 2026, 8:39 PM UTCRecord last updated

Affected versions

• libsoup

  fixed in 3.6.5

• libsoup3

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• mingw-freetype

  Version range not reported

• spice-client-win

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

• libsoup

  Version range not reported

References 16