CVE-2025-12105

Name of the Vulnerable Software and Affected Versions libsoup versions prior to 3.6.5-1ubuntu0.3

Description The libsoup library contains a flaw in its asynchronous message queue handling, specifically when managing HTTP/2 communications. When network operations are aborted at certain times, an internal message queue item can be freed twice due to a lack of state synchronization. This results in a use-after-free memory access, which can cause the affected application to crash. An attacker could potentially exploit this behavior remotely by sending specific HTTP/2 read and cancel sequences, leading to a denial-of-service condition.

Recommendations Update to libsoup version 3.6.5-1ubuntu0.3 or later.