CVE-2025-32907

Name	CVE-2025-32907
Description	A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1103264

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libsoup2.4 (PTS)	bullseye	2.72.0-2	vulnerable
	bullseye (security)	2.72.0-2+deb11u1	vulnerable
	bookworm	2.74.3-1+deb12u1	vulnerable
	sid, trixie	2.74.3-10	vulnerable
libsoup3 (PTS)	bookworm	3.2.2-2	vulnerable
	sid, trixie	3.6.5-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libsoup2.4	source	(unstable)	(unfixed)
libsoup3	source	(unstable)	(unfixed)			1103264

https://gitlab.gnome.org/GNOME/libsoup/-/issues/428