« Volver al listado

CVE-2025-32907

Estado: AplazadaMedia (5.3)—

A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Gnome — LibsoupAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-32907",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-32907",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-14T14:13:20.381645Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.6.5",
              "versionType": "semver"
            }
          ],
          "packageName": "libsoup",
          "collectionURL": "https://gitlab.gnome.org/GNOME/libsoup/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.0"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:3.6.5-3.el10_0.6",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libsoup3",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.8-3.el8_10.1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "mingw-freetype",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:8.10-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "spice-client-win",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.72.0-10.el9_6.1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libsoup",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_0.4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libsoup",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_2.4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libsoup",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.72.0-8.el9_4.4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libsoup",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 6",
          "packageName": "libsoup",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 7",
          "packageName": "libsoup",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "packageName": "libsoup",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-04-14T14:15:24.580",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:4439",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:4440",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:4508",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:7436",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:8128",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:8292",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2025-32907",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359342",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/428",
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1050"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service."
    },
    {
      "lang": "es",
      "value": "Se encontró una falla en libsoup. La implementación de solicitudes de rango HTTP es vulnerable a un ataque de consumo de recursos. Esta falla permite que un cliente malicioso solicite el mismo rango varias veces en una sola solicitud HTTP, lo que provoca que el servidor utilice grandes cantidades de memoria."
    }
  ],
  "lastModified": "2026-06-30T01:16:25.493",
  "sourceIdentifier": "secalert@redhat.com"
}