CVE-2025-32911

A flaw was found in libsoup, which is vulnerable to a use-after-free memory issue not on the heap in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.

Weakness

The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().

Affected Software

Potential Mitigations

• Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
• For example, glibc in Linux provides protection against free of invalid pointers.

References

• https://access.redhat.com/security/cve/CVE-2025-32911
• https://bugzilla.redhat.com/show_bug.cgi?id=2359355