Vulnerabilities
Misconfiguration
Runtime Security
Compliance
CVE Vulnerabilities

CVE-2025-32911

Free of Memory not on the Heap

Published: Apr 15, 2025 | Modified: May 07, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
9 IMPORTANT
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Ubuntu
MEDIUM
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2025-32911
CWEhttps://cwe.mitre.org/data/definitions/590.html

A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.

Weakness

The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().

Affected Software

Name Vendor Start Version End Version
Red Hat Enterprise Linux 8 RedHat libsoup-0:2.62.3-8.el8_10 *
Red Hat Enterprise Linux 8 RedHat libsoup-0:2.62.3-8.el8_10 *
Red Hat Enterprise Linux 8.2 Advanced Update Support RedHat libsoup-0:2.62.3-1.el8_2.4 *
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support RedHat libsoup-0:2.62.3-2.el8_4.4 *
Red Hat Enterprise Linux 8.4 Telecommunications Update Service RedHat libsoup-0:2.62.3-2.el8_4.4 *
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions RedHat libsoup-0:2.62.3-2.el8_4.4 *
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support RedHat libsoup-0:2.62.3-2.el8_6.4 *
Red Hat Enterprise Linux 8.6 Telecommunications Update Service RedHat libsoup-0:2.62.3-2.el8_6.4 *
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions RedHat libsoup-0:2.62.3-2.el8_6.4 *
Red Hat Enterprise Linux 8.8 Extended Update Support RedHat libsoup-0:2.62.3-3.el8_8.4 *
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions RedHat libsoup-0:2.72.0-8.el9_0.4 *
Red Hat Enterprise Linux 9.2 Extended Update Support RedHat libsoup-0:2.72.0-8.el9_2.4 *
Red Hat Enterprise Linux 9.4 Extended Update Support RedHat libsoup-0:2.72.0-8.el9_4.4 *
Libsoup2.4 Ubuntu esm-infra/bionic *
Libsoup2.4 Ubuntu esm-infra/xenial *
Libsoup2.4 Ubuntu focal *
Libsoup2.4 Ubuntu jammy *
Libsoup2.4 Ubuntu noble *
Libsoup2.4 Ubuntu oracular *
Libsoup2.4 Ubuntu plucky *
Libsoup3 Ubuntu esm-apps/jammy *
Libsoup3 Ubuntu noble *
Libsoup3 Ubuntu oracular *
Libsoup3 Ubuntu upstream *

Potential Mitigations

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, glibc in Linux provides protection against free of invalid pointers.

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2025 Aqua Security Software Ltd.   Privacy Policy | Terms of Use