CVE-2025-4969

Name of the Vulnerable Software and Affected Versions libsoup versions 2.4 through 3

Description A flaw was found in the libsoup package due to its failure to correctly verify the termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted multipart HTTP body, causing the libsoup-consuming server to read beyond its allocated memory boundaries, resulting in an out-of-bounds read.

Recommendations For versions 2.4 through 3, consider restricting access to the multipart HTTP message handling functionality until a patch is available. As a temporary workaround, disabling the vulnerable function related to multipart HTTP message verification may help minimize the risk of exploitation.