It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-962 advisory.

    A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-     of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP     server. (CVE-2025-32906)

    A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource     consumption attack. This flaw allows a malicious client to request the same range many times in a single     HTTP request, causing the server to use large amounts of memory. (CVE-2025-32907)

    libsoup: Double free on  soup_message_headers_get_content_disposition() through  soup-message-headers.c     via params GHashTable value (CVE-2025-32911)

    A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is     vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client     or server that uses this function. (CVE-2025-32913)

    A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-     of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of     bounds. (CVE-2025-32914)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libsoup installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-32907 advisory.

  - A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource     consumption attack. This flaw allows a malicious client to request the same range many times in a single     HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of     service. (CVE-2025-32907)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2025_8292 advisory.

    * freetype: OOB write when attempting to parse font subglyph structures related to TrueType GX and     variable font files (CVE-2025-27363)

    * libsoup: Integer overflow in append_param_quoted (CVE-2025-32050)

    * libsoup: Heap buffer overflow in sniff_unknown() (CVE-2025-32052)

    * libsoup: Heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space() (CVE-2025-32053)

    * libsoup: Out of bounds reads in soup_headers_parse_request() (CVE-2025-32906)

    * libsoup: Denial of service in server when client requests a large amount of  overlapping ranges with     Range header (CVE-2025-32907)

    * libsoup: NULL Pointer Dereference on libsoup through  function sniff_mp4 in soup-content-sniffer.c     (CVE-2025-32909)

    * libsoup: Null pointer deference on libsoup via  /auth/soup-auth-digest.c through     soup_auth_digest_authenticate on  client when server omits the realm parameter in an Unauthorized     response with Digest authentication (CVE-2025-32910)

    * libsoup: Double free on  soup_message_headers_get_content_disposition() through  soup-message-     headers.c via params GHashTable value (CVE-2025-32911)

    * libsoup: NULL pointer dereference in  soup_message_headers_get_content_disposition when filename     parameter  is present, but has no value in Content-Disposition header (CVE-2025-32913)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2025_8128 advisory.

    * libsoup: Denial of Service attack to websocket server (CVE-2025-32049)

    * libsoup: Denial of service in server when client requests a large amount of  overlapping ranges with     Range header (CVE-2025-32907)

    * libsoup: Cookie domain validation bypass via uppercase characters in libsoup (CVE-2025-4035)

    * libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup     (CVE-2025-4948)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-1f41505af2 advisory.

    This update fixes these CVEs:
      CVE-2025-4948       CVE-2025-32908       CVE-2025-32907       CVE-2025-4969       CVE-2025-4945       CVE-2025-4476


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
235904	Amazon Linux 2023 : libsoup, libsoup-devel (ALAS2023-2025-962)	Nessus	Amazon Linux Local Security Checks	2025/5/13	2025/5/13	high
241897	Azure Linux 3.0 Security Update: libsoup (CVE-2025-32907)	Nessus	Azure Linux Local Security Checks	2025/7/11	2025/9/15	medium
354511	Rocky Linux 8 [CIQ] Security Update: mingw32-freetype / mingw32-freetype-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_8292)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
354870	Rocky Linux 10.0 [CIQ] Security Update: libsoup3 / libsoup3-debuginfo / libsoup3-debugsource / etc Multiple Vulnerabilities (crlsa-2025_8128)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
244369	Fedora 41 : libsoup3 (2025-1f41505af2)	Nessus	Fedora Local Security Checks	2025/8/6	2026/2/24	medium

检测

插件搜索

high

medium

high

medium

medium