CVE-2025-4476

MEDIUM EPSS 22.6%

Published May 16, 20251y ago · Modified Jun 17, 20262w ago

4.3 CVSS 3.1

Medium

Published May 16, 2025 1y ago

Last Modified Jun 17, 2026 2w ago

Description

A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client application into connecting to the attacker's malicious server.

CVSS Details

Base Score

4.3

Exploitability

2.8

Impact

1.4

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction Required

Scope Unchanged

Confidentiality None

Integrity None

Availability Low

Threat Intelligence

EPSS Exploit Probability

22.6% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-476 NULL Pointer Dereference Memory Safety

References 4

access.redhat.com https://access.redhat.com/security/cve/CVE-2025-4476
bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2366513
gitlab.gnome.org https://gitlab.gnome.org/GNOME/libsoup/-/issues/440
gitlab.gnome.org https://gitlab.gnome.org/GNOME/libsoup/-/work_items/440

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.