CVE-2025-4476 Libsoup: null pointer dereference in libsoup may lead to denial of service
A malicious server can crash client applications using libsoup by sending a crafted 401 response, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-4476?
CVE-2025-4476 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 16 May 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client application into connecting to the attacker's malicious server.
Weakness: CWE-476
Which versions are affected by CVE-2025-4476?
Linux distribution packages (1)
libsoup SUSE:Linux Enterprise Micro 5.2 | All versions | 2.68.4-150200.4.27.1 |
How do I fix CVE-2025-4476?
Apply the vendor's patch.
Is CVE-2025-4476 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-4476 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as AZL-61902, AZL-61910, DEBIAN-CVE-2025-4476, GHSA-qgq4-89p9-qfrh, OESA-2025-2209, OESA-2025-2210 and 3 more.