Libsoup: integer overflow in append_param_quoted

libsoup is the HTTP client/server library GNOME ships with — used by Evolution, gnome-online-accounts, geary, GStreamer's souphttpsrc, and various embedded HTTP consumers on Linux. In the append_param_quoted() helper (which formats key="value" parameters for headers like Content-Disposition), an integer overflow in length arithmetic produces a buffer under-read. The immediate consequence is a crash or a small out-of-bounds memory read — availability impact, no code execution, no controllable memory disclosure per the CVSS vector. Affected versions span libsoup 2.x and 3.x prior to the April 2025 backport wave; RHEL fixes shipped in RHSA-2025:4560 / RHSA-2025:4568 / RHSA-2025:8292 and equivalent Debian/Ubuntu/SUSE updates.

Red Hat's MEDIUM (5.9) is if anything *generous* for this bug. The CVSS vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H — network reachable but high attack complexity, and the sole impact is availability. There is no path to RCE, no confirmed info-leak primitive shown in the advisory, and the affected function is only reached when the application feeds attacker-controlled strings into libsoup's parameter serializer. In practical enterprise fleets — where libsoup is *consuming* HTTP responses from services the user chose to visit — the reachable path is client-side and self-inflicted.

Why this verdict

• Impact ceiling is availability. C:N/I:N/A:H — no code execution, no data disclosure documented. The worst realistic outcome is a crashed Evolution or GStreamer process.
• High attack complexity + user-initiated fetch. libsoup is a client library; the victim has to reach out to attacker-controlled content. This isn't a listener you scan for on the edge.
• Friction audit: (a) attacker needs a hostile endpoint the victim contacts — post-phish or watering-hole positioning; (b) proxies/TLSI often normalize headers; (c) heap hardening frequently traps the under-read into a clean crash.
• Role multiplier — workstation: crash of one GNOME app. Local nuisance. No lateral value.
• Role multiplier — server/appliance (e.g., IBM Power HMC): libsoup is present but the exposed surface is management UI, not an unauthenticated public fetch loop. Chain still ends in DoS of the mgmt component, not fleet compromise.
• Role multiplier — high-value roles (DC, hypervisor, PAM, CI/CD): libsoup is not the canonical HTTP stack for any of these. No plausible high-value-role floor triggers.
• EPSS 0.665% + no KEV + no public weaponized PoC — telemetry confirms the friction audit.

Why not higher?

MEDIUM would require a plausible integrity or confidentiality primitive — neither exists in the advisory. The buffer under-read has not been shown to leak controllable memory back to a remote attacker, and there is no RCE path. A DoS of a desktop-side HTTP consumer does not meet the MEDIUM bar for a fleet of 10,000 hosts.

Why not lower?

Not IGNORE because the fix is trivially available via distro package updates, real Linux workstations do run vulnerable libsoup, and a scriptable client-side crash is still a nuisance surface worth cleaning up during normal patch hygiene. It earns backlog attention, not deprioritization to zero.

1. Ride the normal distro patch cadence — Ensure dnf update libsoup libsoup3 / apt upgrade libsoup2.4-1 libsoup-3.0-0 lands in your monthly Linux workstation baseline. No mitigation SLA applies — remediation target is the standard 365-day window per the noisgate SLA, but there is no reason to defer past the next monthly cycle.
2. Restart long-lived libsoup consumers after update — Evolution, gnome-online-accounts, and any daemon linking libsoup keep the old .so mapped until restart. A needrestart sweep or a scheduled reboot closes the window on the same day as the package install.
3. Egress-filter developer/user workstations through inspecting proxy — A TLS-terminating proxy that normalizes response headers strips most malformed Content-Disposition payloads before they reach the client. This is generic hygiene that already covers many similar client-side parser bugs.
4. Alert on repeated libsoup segfaults in journald — A simple detection: journalctl | grep 'libsoup.*SIGSEGV' piped to your SIEM. Cheap early warning if someone ever weaponizes this into a targeted DoS loop.

Run this on each Linux host (workstation or appliance) as a normal user; root only needed if you also want the needrestart check. Example invocation: ./check_libsoup.sh — no arguments. Exits 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN.

#!/usr/bin/env bash
# check_libsoup.sh — CVE-2025-32050 detector
# Compares installed libsoup version(s) against distro fixed versions.
set -u

VULN=0
FOUND=0

check_rpm() {
  command -v rpm >/dev/null || return
  for pkg in libsoup libsoup3; do
    ver=$(rpm -q --qf '%{VERSION}-%{RELEASE}\n' "$pkg" 2>/dev/null | grep -v 'not installed' || true)
    [ -z "$ver" ] && continue
    FOUND=1
    echo "[rpm] $pkg = $ver"
    # RHEL 9 fixed: libsoup-2.72.0-8.el9_5.1 / libsoup3-3.0.7-3.el9_5.1 (approx from RHSA-2025:4560/4568)
    case "$pkg" in
      libsoup)  min='2.72.0-8.el9_5.1' ;;
      libsoup3) min='3.0.7-3.el9_5.1'  ;;
    esac
    if ! rpm --quiet -q "$pkg" || [ "$(printf '%s\n%s\n' "$min" "$ver" | sort -V | head -1)" != "$min" ]; then
      # installed < min
      if [ "$(printf '%s\n%s\n' "$ver" "$min" | sort -V | head -1)" = "$ver" ] && [ "$ver" != "$min" ]; then
        echo "  -> VULNERABLE (need >= $min)"
        VULN=1
      else
        echo "  -> patched"
      fi
    fi
  done
}

check_dpkg() {
  command -v dpkg-query >/dev/null || return
  for pkg in libsoup2.4-1 libsoup-3.0-0; do
    ver=$(dpkg-query -W -f='${Version}\n' "$pkg" 2>/dev/null || true)
    [ -z "$ver" ] && continue
    FOUND=1
    echo "[dpkg] $pkg = $ver"
    # Consult your distro's security tracker for the exact fixed epoch; flag if pre-2025-04.
    # Heuristic: any libsoup built before 2025-04-03 upstream commit is suspect.
    echo "  -> cross-check against https://security-tracker.debian.org / USN for CVE-2025-32050"
  done
}

check_rpm
check_dpkg

if [ "$FOUND" -eq 0 ]; then
  echo "UNKNOWN — no libsoup package found via rpm/dpkg"
  exit 2
fi

if [ "$VULN" -eq 1 ]; then
  echo "RESULT: VULNERABLE"
  exit 1
fi

echo "RESULT: PATCHED"
exit 0

Sources

1. GHSA-99xf-gcww-2c64
2. Red Hat Bugzilla 2357067
3. RHSA-2025:4560
4. RHSA-2025:4568
5. RHSA-2025:8292
6. IBM Power HMC bulletin
7. OffSeq Threat Radar summary