Technical impact
The vulnerability is an out‑of‑bounds read in libsoup’s multipart input stream processing. It occurs when the library parses an oversized multipart boundary string, allowing an unauthenticated attacker to send a crafted HTTP response that forces the internal reader to read past its allocated buffer. This can cause application crashes or, in rare cases, expose fragments of memory; the primary consequence is denial of service. The flaw is identified as CWE‑125.
Affected Systems
Red Hat Enterprise Linux 6, 7, 8, 9 and 10 – these distributions include a vulnerable version of libsoup in applications that handle multipart HTTP requests. The affected component is the libsoup shared library used by services on those systems.
Risk and Exploitability
The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers require network access to services that use libsoup; no local privilege escalation is needed. Exploitation involves delivering a crafted HTTP response with an oversized boundary, which may trigger a crash or limited memory disclosure. Given the low public exploit activity, the risk is moderate for internal deployments but higher for services exposed to untrusted networks.
