CVE-2025-2784

MEDIUM

MEDIUM Priority: 0.06 BB Relevance: 73/100

Published: 2025-04-03 Modified: 2026-11-05 First seen: 2026-11-01 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network

AC: Low

PR: None

UI: None

S: Unchanged

C: Low

I: Low

A: None

Description

A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.

Weakness Classification (1)

CWE-125 — Out-of-bounds Read

Affected Software (59)

Vendor	Product	Version
—	—	0 < 3.6.5
—	—	0 < 3.6.5
gnome	libsoup	< 3.6.5
redhat	codeready_linux_builder	10.0
redhat	codeready_linux_builder_for_arm64	10.0_aarch64
redhat	codeready_linux_builder_for_arm64_eus	10.0_aarch64
redhat	codeready_linux_builder_for_ibm_z_systems	10.0_s390x
redhat	codeready_linux_builder_for_ibm_z_systems_eus	10.0_s390x
redhat	codeready_linux_builder_for_power_little_endian	10.0_ppc64le
redhat	codeready_linux_builder_for_power_little_endian_eus	10.0_ppc64le
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0
redhat	enterprise_linux	10.0
redhat	enterprise_linux_eus	8.8
redhat	enterprise_linux_eus	9.2
redhat	enterprise_linux_eus	9.4
redhat	enterprise_linux_eus	9.6
redhat	enterprise_linux_eus	10.0
redhat	enterprise_linux_for_arm_64	8.0_aarch64
redhat	enterprise_linux_for_arm_64	9.0_aarch64
redhat	enterprise_linux_for_arm_64	10.0_aarch64
redhat	enterprise_linux_for_arm_64_eus	8.8_aarch64
redhat	enterprise_linux_for_arm_64_eus	9.2_aarch64
redhat	enterprise_linux_for_arm_64_eus	9.4_aarch64
redhat	enterprise_linux_for_arm_64_eus	9.6_aarch64
redhat	enterprise_linux_for_arm_64_eus	10.0_aarch64
redhat	enterprise_linux_for_ibm_z_systems	8.0_s390x
redhat	enterprise_linux_for_ibm_z_systems	9.0_s390x
redhat	enterprise_linux_for_ibm_z_systems	10.0_s390x
redhat	enterprise_linux_for_ibm_z_systems_eus	8.8_s390x

Showing 30 of 59 entries