Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-32911
CVE-2025-32911:
Alma Linux vulnerability analysis and mitigation
Overview
A critical vulnerability (CVE-2025-32911) was discovered in libsoup, affecting versions prior to 3.6.3. The vulnerability was disclosed on April 15, 2025, and involves a use-after-free memory issue not on the heap in the soupmessageheadersgetcontent_disposition() function. This security flaw affects various Linux distributions including Red Hat Enterprise Linux 8 and 9, Debian, and Ubuntu systems running libsoup2.4 and earlier versions of libsoup3 (NVD, Ubuntu Security).
Technical details
The vulnerability is classified with CWE-590 (Free of Memory not on the heap) and has received a CVSS v3.1 base score of 9.0 (Critical) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. The issue specifically occurs in the soupmessageheadersgetcontent_disposition() function through 'soup-message-headers.c' via 'params' GHashTable value (Red Hat XML, Debian Tracker).
Impact
The vulnerability allows a malicious HTTP client to cause memory corruption in the libsoup server, potentially leading to high impacts on confidentiality, integrity, and availability of the affected systems. The critical CVSS score of 9.0 indicates severe potential consequences if exploited (NVD, Ubuntu Security).
Mitigation and workarounds
Currently, no direct mitigation is available for this vulnerability. However, the issue has been fixed in libsoup3 version 3.6.4-1 and later. Users are advised to upgrade to the fixed version when available. The fix has been implemented through a commit in the libsoup repository (Debian Tracker).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management