Bug#1106204: libsoup3: CVE-2025-4948

[Salvatore Bonaccorso]

Source: libsoup3
Version: 3.6.5-1
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/libsoup/-/issues/449
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for libsoup3.

CVE-2025-4948[0]:
| A flaw was found in the soup_multipart_new_from_message() function
| of the libsoup HTTP library, which is commonly used by GNOME and
| other applications to handle web communications. The issue occurs
| when the library processes specially crafted multipart messages. Due
| to improper validation, an internal calculation can go wrong,
| leading to an integer underflow. This can cause the program to
| access invalid memory and crash. As a result, any application or
| server using libsoup could be forced to exit unexpectedly, creating
| a denial-of-service (DoS) risk.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-4948
    https://www.cve.org/CVERecord?id=CVE-2025-4948
[1] https://gitlab.gnome.org/GNOME/libsoup/-/issues/449

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore