PT-2025-22321 · Libsoup+5 · Libsoup+5

CVE-2025-4969 · Published 2025-01-01 · Updated 2026-06-30

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions libsoup versions 2.4 through 3

Description A flaw was found in the libsoup package due to its failure to correctly verify the termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted multipart HTTP body, causing the libsoup-consuming server to read beyond its allocated memory boundaries, resulting in an out-of-bounds read.

Recommendations For versions 2.4 through 3, consider restricting access to the multipart HTTP message handling functionality until a patch is available. As a temporary workaround, disabling the vulnerable function related to multipart HTTP message verification may help minimize the risk of exploitation.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

AZL-61945

AZL-61958

BDU:2025-10261

CVE-2025-4969

DLA-4398-1

OESA-2025-1632

OESA-2026-2337

OESA-2026-2338

OESA-2026-2339

OPENSUSE-SU-2025:15185-1

OPENSUSE-SU-2025:15189-1

SUSE-SU-2025:01794-1

SUSE-SU-2025:01801-1

SUSE-SU-2025:01802-1

SUSE-SU-2025:01812-1

SUSE-SU-2025:01817-1

SUSE-SU-2025:01864-1

SUSE-SU-2025:20453-1

SUSE-SU-2025:20598-1

SUSE-SU-2025_01794-1

SUSE-SU-2025_01812-1

SUSE-SU-2025_01817-1

USN-7643-1

Affected Products

Debian

Linuxmint

Red Os

Suse

Ubuntu

Libsoup

References · 93

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4969.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-0716 · Security Note
• https://ubuntu.com/security/CVE-2025-4948 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-4969 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:01794-1 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4969 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-4969 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2339 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4476 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15185-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-4945 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7643-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:20598-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46420 · Security Note