Read the docs
TI-2025-02434 Aliases CVE-2025-2784GHSA-5qxx-2mqf-3v7g

Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content

Priority MEDIUM 64CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · High
Fix status
Partial Red Hat: 21 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00876 59th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial libsoup: 3.6.5Red Hat: 12 advisoriesRed Hat: 21 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—libsoupbefore 3.6.53.6.5Patch availableCNA
Red HatRed Hat Enterprise Linux 10—3.6.5-3.el10_0Patch availableCNA
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support—2.62.2-9.el7_9Patch availableCNA
Red HatRed Hat Enterprise Linux 8—2.62.3-9.el8_10Patch availableCNA
Red HatRed Hat Enterprise Linux 8—2.62.3-9.el8_10Patch availableCNA
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—2.62.3-1.el8_2.5Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—2.62.3-2.el8_4.5Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—2.62.3-2.el8_6.5Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service—2.62.3-2.el8_6.5Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions—2.62.3-2.el8_6.5Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support—2.62.3-3.el8_8.5Patch availableCNA
Red HatRed Hat Enterprise Linux 9—2.72.0-10.el9_6.2Patch availableCNA
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions—2.72.0-8.el9_0.5Patch availableCNA
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support—2.72.0-8.el9_2.5Patch availableCNA
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—2.72.0-8.el9_4.5Patch availableCNA
Red HatRed Hat Enterprise Linux 6——No fix listedCNA
  • libsoup Vendor— Affected before 3.6.5 Fixed in 3.6.5 Patch available CNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 3.6.5-3.el10_0 Patch available CNA
  • Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 2.62.2-9.el7_9 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 2.62.3-9.el8_10 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 2.62.3-9.el8_10 Patch available CNA
  • Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 2.62.3-1.el8_2.5 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 2.62.3-2.el8_4.5 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 2.62.3-2.el8_6.5 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Telecommunications Update Service VendorRed Hat Affected — Fixed in 2.62.3-2.el8_6.5 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.62.3-2.el8_6.5 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 2.62.3-3.el8_8.5 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.72.0-10.el9_6.2 Patch available CNA
  • Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.72.0-8.el9_0.5 Patch available CNA
  • Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 2.72.0-8.el9_2.5 Patch available CNA
  • Red Hat Enterprise Linux 9.4 Extended Update Support VendorRed Hat Affected — Fixed in 2.72.0-8.el9_4.5 Patch available CNA
  • Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE configurations NVD · 57

CPEVersionsRoleVendor
cpe:2.3:a:gnome:libsoup:*:*:*:*:*:*:*:*before 3.6.5VulnerableGNOME
cpe:2.3:a:redhat:codeready_linux_builder:10.0:*:*:*:*:*:*:*10.0VulnerableRed Hat
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:10.0_aarch64:*:*:*:*:*:*:*10.0_aarch64VulnerableRed Hat
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:10.0_aarch64:*:*:*:*:*:*:*10.0_aarch64VulnerableRed Hat
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:10.0_s390x:*:*:*:*:*:*:*10.0_s390xVulnerableRed Hat
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:10.0_s390x:*:*:*:*:*:*:*10.0_s390xVulnerableRed Hat
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:10.0_ppc64le:*:*:*:*:*:*:*10.0_ppc64leVulnerableRed Hat
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:10.0_ppc64le:*:*:*:*:*:*:*10.0_ppc64leVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
  • cpe:2.3:a:gnome:libsoup:*:*:*:*:*:*:*:* Versions before 3.6.5 Vulnerable ·GNOME
  • cpe:2.3:a:redhat:codeready_linux_builder:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:10.0_aarch64:*:*:*:*:*:*:* Versions 10.0_aarch64 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:10.0_aarch64:*:*:*:*:*:*:* Versions 10.0_aarch64 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:10.0_s390x:*:*:*:*:*:*:* Versions 10.0_s390x Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:10.0_s390x:*:*:*:*:*:*:* Versions 10.0_s390x Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:10.0_ppc64le:*:*:*:*:*:*:* Versions 10.0_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:10.0_ppc64le:*:*:*:*:*:*:* Versions 10.0_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
Show 47 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*10.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*8.8VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*9.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*9.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*9.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:*10.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:*8.0_aarch64VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*9.0_aarch64VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:10.0_aarch64:*:*:*:*:*:*:*10.0_aarch64VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8_aarch64:*:*:*:*:*:*:*8.8_aarch64VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.2_aarch64:*:*:*:*:*:*:*9.2_aarch64VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*9.4_aarch64VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.6_aarch64:*:*:*:*:*:*:*9.6_aarch64VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:10.0_aarch64:*:*:*:*:*:*:*10.0_aarch64VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*8.0_s390xVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*9.0_s390xVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.0_s390x:*:*:*:*:*:*:*10.0_s390xVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:*8.8_s390xVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:*9.2_s390xVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*9.4_s390xVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:*9.6_s390xVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:10.0_s390x:*:*:*:*:*:*:*10.0_s390xVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*8.0_ppc64leVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*9.0_ppc64leVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.0_ppc64le:*:*:*:*:*:*:*10.0_ppc64leVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8_ppc64le:*:*:*:*:*:*:*8.8_ppc64leVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:*9.2_ppc64leVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*9.4_ppc64leVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:*9.6_ppc64leVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:10.0_ppc64le:*:*:*:*:*:*:*10.0_ppc64leVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*8.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*8.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:*9.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*9.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.6:*:*:*:*:*:*:*9.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6_ppc64le:*:*:*:*:*:*:*8.6_ppc64leVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.0_ppc64le:*:*:*:*:*:*:*9.0_ppc64leVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.6_ppc64le:*:*:*:*:*:*:*9.6_ppc64leVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:*8.8VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*8.8VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*9.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*9.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.6:*:*:*:*:*:*:*9.6VulnerableRed Hat
  • cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:* Versions 9.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:* Versions 9.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:* Versions 8.0_aarch64 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:* Versions 9.0_aarch64 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_arm_64:10.0_aarch64:*:*:*:*:*:*:* Versions 10.0_aarch64 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8_aarch64:*:*:*:*:*:*:* Versions 8.8_aarch64 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.2_aarch64:*:*:*:*:*:*:* Versions 9.2_aarch64 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:* Versions 9.4_aarch64 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.6_aarch64:*:*:*:*:*:*:* Versions 9.6_aarch64 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:10.0_aarch64:*:*:*:*:*:*:* Versions 10.0_aarch64 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:* Versions 8.0_s390x Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* Versions 9.0_s390x Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.0_s390x:*:*:*:*:*:*:* Versions 10.0_s390x Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:* Versions 8.8_s390x Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:* Versions 9.2_s390x Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:* Versions 9.4_s390x Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:* Versions 9.6_s390x Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:10.0_s390x:*:*:*:*:*:*:* Versions 10.0_s390x Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:* Versions 8.0_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* Versions 9.0_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.0_ppc64le:*:*:*:*:*:*:* Versions 10.0_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8_ppc64le:*:*:*:*:*:*:* Versions 8.8_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:* Versions 9.2_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:* Versions 9.4_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:* Versions 9.6_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:10.0_ppc64le:*:*:*:*:*:*:* Versions 10.0_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:* Versions 9.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:9.6:*:*:*:*:*:*:* Versions 9.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6_ppc64le:*:*:*:*:*:*:* Versions 8.6_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.0_ppc64le:*:*:*:*:*:*:* Versions 9.0_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.6_ppc64le:*:*:*:*:*:*:* Versions 9.6_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:* Versions 9.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.6:*:*:*:*:*:*:* Versions 9.6 Vulnerable ·Red Hat

Remediation

  • Fix · CNA libsoup Fixed in 3.6.5

Red Hat 12 advisories

  • RHSA-2025:21657 Released 2025-11-18 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) libsoup-2.62.2-9.el7_9, libsoup-2.62.2-9.el7_9.ppc, libsoup-devel-2.62.2-9.el7_9 +1
  • RHSA-2025:9179 Released 2025-06-17 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) libsoup-2.62.2-6.el7_9, libsoup-devel-2.62.2-6.el7_9
  • RHSA-2025:8663 Released 2025-06-09 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) libsoup-devel-2.62.3-2.el8_4.5
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) libsoup-2.62.3-2.el8_4.5
Show 9 more Red Hat advisories
  • RHSA-2025:8482 Released 2025-06-04 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) libsoup-devel-2.62.3-2.el8_6.5
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) libsoup-devel-2.62.3-2.el8_6.5
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) libsoup-devel-2.62.3-2.el8_6.5
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) libsoup-2.62.3-2.el8_6.5
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) libsoup-2.62.3-2.el8_6.5
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) libsoup-2.62.3-2.el8_6.5
  • RHSA-2025:8480 Released 2025-06-04 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) libsoup-devel-2.62.3-1.el8_2.5
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) libsoup-2.62.3-1.el8_2.5
  • RHSA-2025:8481 Released 2025-06-04 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) libsoup-2.72.0-8.el9_0.5, libsoup-devel-2.72.0-8.el9_0.5
  • RHSA-2025:8252 Released 2025-05-28 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) libsoup-devel-2.62.3-3.el8_8.5
    • Red Hat Enterprise Linux BaseOS EUS (v.8.8) libsoup-2.62.3-3.el8_8.5
  • RHSA-2025:8140 Released 2025-05-26 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) libsoup-2.72.0-8.el9_2.5, libsoup-devel-2.72.0-8.el9_2.5
  • RHSA-2025:8139 Released 2025-05-26 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) libsoup-2.72.0-8.el9_4.5, libsoup-devel-2.72.0-8.el9_4.5
  • RHSA-2025:8132 Released 2025-05-26 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream (v. 8) libsoup-devel-2.62.3-9.el8_10
    • Red Hat Enterprise Linux BaseOS (v. 8) libsoup-2.62.3-9.el8_10
  • RHSA-2025:8126 Released 2025-05-26 · Red Hat rating Important
    libsoup security update
    • Red Hat Enterprise Linux AppStream (v. 9) libsoup-2.72.0-10.el9_6.2, libsoup-devel-2.72.0-10.el9_6.2
  • RHSA-2025:7505 Released 2025-05-13 · Red Hat rating Important
    libsoup3 security update
    • Red Hat Enterprise Linux AppStream (v. 10) libsoup3-3.6.5-3.el10_0, libsoup3-devel-3.6.5-3.el10_0
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libsoup3-doc-3.6.5-3.el10_0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:7505
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:8132
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:8126
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2025:8480
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2025:8663
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2025:8482
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2025:8482
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:8481
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2025:8252
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2025:8140
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:8139
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2025:8482
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2025:8132
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2025:8480
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2025:8663
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2025:8482
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2025:8482
Red Hat Enterprise Linux BaseOS EUS (v.8.8)Fixed RHSA-2025:8252
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2025:8482
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2025:7505
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2025:21657

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-2784
  2. 2026-10-03 Alias added: GHSA-5qxx-2mqf-3v7g
  3. 2026-11-01 Affected versions changed · CNA
  4. 2026-11-01 Affected versions changed · Red Hat

References

Exploit 1

Advisory 13

  • TI-2019-06284 Memory corruption in webkitgtk KEVCVSS 3.1HIGH 8.8
  • TI-2023-04522 Glibc: buffer overflow in ld.so leading to privilege escalation KEVCVSS 3.1HIGH 7.8
  • TI-2022-00753 A flaw was found in the way the "flags" member of the new pipe buffer structure was… KEVCVSS 3.1HIGH 7.8
  • TI-2022-00413 Improper authentication in kernel KEVCVSS 3.1HIGH 7.8
  • TI-2021-19843 Out-of-bounds read in Samba CVSS 3.1HIGH 8.8
  • TI-2022-00359 Out-of-bounds write in kernel CVSS 3.1HIGH 8.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences