CVE-2025-32053: 
Rocky Linux vulnerability analysis and mitigation

A heap buffer over-read vulnerability was discovered in libsoup (CVE-2025-32053), affecting the sniff_feed_or_html() and skip_insignificant_space() functions. The vulnerability was reported on April 3, 2025, and affects multiple versions of libsoup2.4 and libsoup3 packages (NVD, Debian Tracker).

The vulnerability is classified as CWE-126 (Buffer Over-read) with a CVSS v3.1 base score of 6.5 (Medium). The issue occurs in the content sniffer's sniff_feed_or_html() and skip_insignificant_space() functions, where libsoup clients may perform out-of-bounds reads when processing crafted HTTP responses from servers (Red Hat Bugzilla).

When exploited, this vulnerability could allow attackers to cause applications using libsoup to crash, resulting in a denial of service condition. The vulnerability affects the confidentiality and availability of the system, as indicated by the CVSS metrics showing Low impact on confidentiality and availability (Ubuntu Security).

The vulnerability has been fixed in libsoup3 version 3.6.1 and later, and in libsoup2.4 version 2.74.3-10. Various Linux distributions have released security updates to address this issue. Ubuntu has released patches for versions 20.04 LTS through 24.10, and Debian has fixed the issue in their 'sid' release (Debian Tracker, Ubuntu Security).