PT-2025-22321 · Libsoup+5 · Libsoup+5

CVE-2025-4969 · Publicado 2025-01-01 · Atualizado 2026-06-30

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions libsoup versions 2.4 through 3

Description A flaw was found in the libsoup package due to its failure to correctly verify the termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted multipart HTTP body, causing the libsoup-consuming server to read beyond its allocated memory boundaries, resulting in an out-of-bounds read.

Recommendations For versions 2.4 through 3, consider restricting access to the multipart HTTP message handling functionality until a patch is available. As a temporary workaround, disabling the vulnerable function related to multipart HTTP message verification may help minimize the risk of exploitation.

Exploit

Correção

DoS

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

AZL-61945

AZL-61958

BDU:2025-10261

CVE-2025-4969

DLA-4398-1

OESA-2025-1632

OESA-2026-2337

OESA-2026-2338

OESA-2026-2339

OPENSUSE-SU-2025:15185-1

OPENSUSE-SU-2025:15189-1

SUSE-SU-2025:01794-1

SUSE-SU-2025:01801-1

SUSE-SU-2025:01802-1

SUSE-SU-2025:01812-1

SUSE-SU-2025:01817-1

SUSE-SU-2025:01864-1

SUSE-SU-2025:20453-1

SUSE-SU-2025:20598-1

SUSE-SU-2025_01794-1

SUSE-SU-2025_01812-1

SUSE-SU-2025_01817-1

USN-7643-1

Produtos afetados

Debian

Linuxmint

Red Os

Suse

Ubuntu

Libsoup

Referências · 93

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4969.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-0716 · Nota de Segurança
• https://ubuntu.com/security/CVE-2025-4948 · Aviso do Fabricante
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-4969 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-4945 · Nota
• https://bugzilla.suse.com/1243422 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2025:01794-1 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-libsoup-21082025 · Nota
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-4969 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2025-4969 · Aviso do Fabricante
• https://bugzilla.suse.com/1243314 · Nota
• https://osv.dev/vulnerability/OESA-2026-2339 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-4476 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2025:15185-1 · Aviso do Fabricante