Bug#1106248: libsoup3: CVE-2025-4969

[Salvatore Bonaccorso]

Source: libsoup3
Version: 3.6.5-1
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/libsoup/-/issues/447
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for libsoup3.

CVE-2025-4969[0]:
| A vulnerability was found in the libsoup package. This flaw stems
| from its failure to correctly verify the termination of multipart
| HTTP messages. This can allow a remote attacker to send a specially
| crafted multipart HTTP body, causing the libsoup-consuming server to
| read beyond its allocated memory boundaries (out-of-bounds read).


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-4969
    https://www.cve.org/CVERecord?id=CVE-2025-4969
[1] https://gitlab.gnome.org/GNOME/libsoup/-/issues/447

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore