DEBIAN-CVE-2025-4948

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2025-4948
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-4948.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2025-4948
Upstream
Downstream
Published
2025-05-19T16:15:36Z
Modified
2026-09-01T16:06:19Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart messages. Due to improper validation, an internal calculation can go wrong, leading to an integer underflow. This can cause the program to access invalid memory and crash. As a result, any application or server using libsoup could be forced to exit unexpectedly, creating a denial-of-service (DoS) risk.

References

Affected packages

Debian:12 / libsoup2.4

Package

Name
libsoup2.4
Purl
pkg:deb/debian/libsoup2.4?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.74.3-1
2.74.3-1+deb12u1
2.74.3-2
2.74.3-3
2.74.3-3.1~exp1
2.74.3-3.1~exp2
2.74.3-3.1~exp3
2.74.3-5
2.74.3-6
2.74.3-7
2.74.3-8
2.74.3-8.1
2.74.3-9
2.74.3-10
2.74.3-10.1
2.74.3-11

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-4948.json"

Debian:13 / libsoup2.4

Package

Name
libsoup2.4
Purl
pkg:deb/debian/libsoup2.4?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.74.3-10.1
2.74.3-11

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-4948.json"

Debian:12 / libsoup3

Package

Name
libsoup3
Purl
pkg:deb/debian/libsoup3?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.2.2-2
3.2.3-0+deb12u1
3.2.3-0+deb12u2
3.3.1-1
3.4.0-1
3.4.1-1
3.4.2-1
3.4.2-2
3.4.2-3
3.4.2-4
3.4.3-1
3.4.4-1
3.4.4-2
3.4.4-3
3.4.4-4
3.4.4-5
3.5.2-1
3.6.0-1
3.6.0-2
3.6.0-3
3.6.0-4
3.6.1-1
3.6.4-1
3.6.4-2
3.6.4-3
3.6.5-1
3.6.5-2
3.6.5-3
3.6.5-4
3.6.5-5
3.6.5-6
3.6.5-7
3.6.5-8
3.6.5-9
3.6.6-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-4948.json"

Debian:13 / libsoup3

Package

Name
libsoup3
Purl
pkg:deb/debian/libsoup3?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.6.5-2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-4948.json"

Debian:14 / libsoup3

Package

Name
libsoup3
Purl
pkg:deb/debian/libsoup3?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.6.5-2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-4948.json"