CVE-2025-12105 Libsoup: heap use-after-free in libsoup message queue handling during http/2 read completion
Remote attackers can cause denial of service in applications using libsoup by triggering specific HTTP/2 read and cancel sequences that lead to a use-after-free crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-12105?
CVE-2025-12105 is a high-severity use after free vulnerability in GNOME Red Hat Enterprise Linux 10, published on 23 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-based applications to manage HTTP/2 communications. When network operations are aborted at specific timing intervals, an internal message queue item may be freed twice due to missing state synchronization. This leads to a use-after-free memory access, potentially crashing the affected application. Attackers could exploit this behavior remotely by triggering specific HTTP/2 read and cancel sequences, resulting in a denial-of-service condition.
Weakness: CWE-416
Which versions are affected by CVE-2025-12105?
Linux distribution packages (17)
libsoup3-doc AlmaLinux:10 | All versions | 3.6.5-3.el10_1.7 |
libsoup3 Red Hat:enterprise_linux:10.1 | All versions | 0:3.6.5-3.el10_1.7 |
libsoup3-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:3.6.5-3.el10_1.7 |
libsoup3-debugsource Red Hat:enterprise_linux:10.1 | All versions | 0:3.6.5-3.el10_1.7 |
libsoup3-devel Red Hat:enterprise_linux:10.1 | All versions | 0:3.6.5-3.el10_1.7 |
libsoup3-doc Red Hat:enterprise_linux:10.1 | All versions | 0:3.6.5-3.el10_1.7 |
libsoup3 Red Hat:enterprise_linux_eus:10.0 | All versions | 0:3.6.5-3.el10_0.10 |
libsoup3-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:3.6.5-3.el10_0.10 |
libsoup3-debugsource Red Hat:enterprise_linux_eus:10.0 | All versions | 0:3.6.5-3.el10_0.10 |
libsoup3-devel Red Hat:enterprise_linux_eus:10.0 | All versions | 0:3.6.5-3.el10_0.10 |
libsoup3-doc Red Hat:enterprise_linux_eus:10.0 | All versions | 0:3.6.5-3.el10_0.10 |
libsoup3 Rocky Linux:10 | All versions | 0:3.6.5-3.el10_1.7 |
libsoup SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 3.4.4-150600.3.21.1 |
libsoup SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 3.4.4-150600.3.21.1 |
libsoup SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 3.4.4-150600.3.21.1 |
libsoup openSUSE:Leap 15.6 | All versions | 3.4.4-150600.3.21.1 |
libsoup openSUSE:Tumbleweed | All versions | 3.6.5-9.1 |
How do I fix CVE-2025-12105?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-12105 being exploited?
There is no known exploitation of CVE-2025-12105 in the wild and no public exploit code.
Sources
Also known as ALSA-2025:23139, AZL-72841, DEBIAN-CVE-2025-12105, ECHO-4ebf-bc2c-395e, GHSA-gppq-jw9r-4v4j, RHSA-2025:23139 and 6 more.