Technical impact
A flaw in libsoup causes an integer underflow when it processes a zero‑length resource, resulting in a buffer overread. The overread can expose sensitive information from memory or trigger a crash that causes application‑level denial of service.
Affected Systems
The vulnerability affects systems running Red Hat Enterprise Linux 10, 6, 7, 8, and 9. The affected component is the libsoup library bundled with these operating systems; no specific minor or patch version is identified.
Risk and Exploitability
The CVSS base score of 6.5 indicates a medium severity. The EPSS score is shown as less than 1%, which suggests a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is not explicitly documented in the available data; it is likely that an attacker could trigger the flaw by sending crafted HTTP requests or other network traffic to an application that uses libsoup. With no official workaround or patch currently available, the risk is primarily mitigated by monitoring for exploitation attempts and applying any future Red Hat updates that address the issue.
Ubuntu USN