CVE-2025-4969

Name	CVE-2025-4969
Description	A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted multipart HTTP body, causing the libsoup-consuming server to read beyond its allocated memory boundaries (out-of-bounds read).
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4398-1
Debian Bugs	1106248, 1106325

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libsoup2.4 (PTS)	bookworm	2.74.3-1+deb12u1	vulnerable
	trixie	2.74.3-10.1	vulnerable
libsoup3 (PTS)	bookworm	3.2.3-0+deb12u2	vulnerable
	trixie	3.6.5-3	fixed
	forky, sid	3.6.6-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
libsoup2.4	source	bullseye	2.72.0-2+deb11u3	DLA-4398-1
libsoup2.4	source	(unstable)	2.74.3-11		1106325
libsoup3	source	(unstable)	3.6.5-2		1106248

Notes

[bookworm] - libsoup3 <no-dsa> (Minor issue)
[trixie] - libsoup2.4 <no-dsa> (Minor issue)
[bookworm] - libsoup2.4 <no-dsa> (Minor issue)
https://gitlab.gnome.org/GNOME/libsoup/-/issues/447
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/467