DEBIAN-CVE-2025-4476
- Source
- https://security-tracker.debian.org/tracker/DEBIAN-CVE-2025-4476
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-4476.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2025-4476
- Upstream
- Published
- 2025-05-16T18:16:10Z
- Modified
- 2025-09-19T06:16:13Z
- Summary
- [none]
- Details
-
A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client application into connecting to the attacker's malicious server.
- References
Affected packages
Debian:13 / libsoup3
Package
- Name
- libsoup3
- Purl
- pkg:deb/debian/libsoup3?arch=source
Debian:14 / libsoup3
Package
- Name
- libsoup3
- Purl
- pkg:deb/debian/libsoup3?arch=source