A flaw in the libsoup library allows a malicious HTTP client to trigger an out-of-bounds read when the soup_multipart_new_from_message() function processes a multipart message. This out-of-bounds read, identified as CWE-125, can cause the library to read beyond a buffer boundary, resulting in a crash or process exit and thus a denial of service.

All specified Red Hat Enterprise Linux platforms—including RHEL 6, RHEL 7 with extended lifecycle or extended update support, RHEL 8 (versions 8.2, 8.4, 8.6 and 8.8), RHEL 9 (versions 9.0, 9.2, 9.4), and RHEL 10—contain the affected libsoup component and are therefore vulnerable.

With a CVSS score of 7.4, the vulnerability poses a high impact, but the EPSS score of less than 1% indicates a low current exploitation probability. It is not listed in the CISA KEV catalog. The attack vector is likely a remote HTTP client sending a crafted multipart request to a server that uses libsoup, and the flaw only provides denial of service rather than remote code execution.