CVE-2025-4945 — Integer Overflow or Wraparound

Vendor	Product	Version range	Fixed in
debian	libsoup2.4	< libsoup2.4 2.72.0-2+deb11u3 (bullseye)	libsoup2.4 2.72.0-2+deb11u3 (bullseye)
debian	libsoup3	< libsoup2.4 2.72.0-2+deb11u3 (bullseye)	libsoup2.4 2.72.0-2+deb11u3 (bullseye)

OSV

libsoup3, libsoup2.4 vulnerabilities

osv·2025-07-17·CVSS 5.3

CVE-2025-32907 [MEDIUM] libsoup3, libsoup2.4 vulnerabilities libsoup3, libsoup2.4 vulnerabilities Jan Różański discovered that libsoup incorrectly handled range headers in an HTTP request. An attacker could possibly use this issue to cause libsoup to consume excessive memory, resulting in a denial of service. (CVE-2025-32907) Alon Zahavi discovered that libsoup incorrectly handled memory when parsing HTTP requests. An attacker could possibly use this issue to send a maliciously crafted HTTP request to the server, causing a denial of service or obtaining sensitive information. This issue only affected Ubuntu 25.04. (CVE-2025-32914) It was discovered that libsoup incorrectly handled memory when parsing the expiration date of maliciously crafted cookies. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-4945) It was

GHSA

GHSA-mwcf-jv2p-mmpx: A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software

ghsa_unreviewed·2025-05-19

CVE-2025-4945 [LOW] CWE-190 GHSA-mwcf-jv2p-mmpx: A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior. The issue stems from improper validation of large integer inputs during date arithmetic operations within the cookie parsing routines.

OSV

CVE-2025-4945: A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software

osv·2025-05-19·CVSS 3.7

CVE-2025-4945 [LOW] CVE-2025-4945: A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior. The issue stems from improper validation of large integer inputs during date arithmetic operations within the cookie parsing routines.

Ubuntu

libsoup vulnerabilities

vendor_ubuntu·2025-07-17·CVSS 5.3

CVE-2025-4969 [MEDIUM] libsoup vulnerabilities Title: libsoup vulnerabilities Summary: Several security issues were fixed in libsoup. Jan Różański discovered that libsoup incorrectly handled range headers in an HTTP request. An attacker could possibly use this issue to cause libsoup to consume excessive memory, resulting in a denial of service. (CVE-2025-32907) Alon Zahavi discovered that libsoup incorrectly handled memory when parsing HTTP requests. An attacker could possibly use this issue to send a maliciously crafted HTTP request to the server, causing a denial of service or obtaining sensitive information. This issue only affected Ubuntu 25.04. (CVE-2025-32914) It was discovered that libsoup incorrectly handled memory when parsing the expiration date of maliciously crafted cookies. An attacker could possibly use this issue to

Red Hat

libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup

vendor_redhat·2025-05-19·CVSS 3.7

CVE-2025-4945 [LOW] CWE-190 libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior. The issue stems from improper validation of large integer inputs during date arithmetic operations within the cookie parsing routines. A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of co

Debian

CVE-2025-4945: libsoup2.4 - A flaw was found in the cookie parsing logic of the libsoup HTTP library, used i...

vendor_debian·2025·CVSS 3.7

CVE-2025-4945 [LOW] CVE-2025-4945: libsoup2.4 - A flaw was found in the cookie parsing logic of the libsoup HTTP library, used i... A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior. The issue stems from improper validation of large integer inputs during date arithmetic operations within the cookie parsing routines. Scope: local bookworm: open bullseye: resolved (fixed in 2.72.0-2+deb11u3) trixie: open

Citrix

Citrix Security Bulletin CTX213313

vendor_citrix·CVSS 6.1

CVE-2016-4945 [MEDIUM] Citrix Security Bulletin CTX213313 Citrix Security Bulletin CTX213313 CVE References: CVE-2016-4945, CVE-2025-12101, CVE-2025-62626, CVE-2026-23554, CVE-2026-3055, CVE-2026-4368, CVE-2026-4397 Affected Products: Citrix ADM, Citrix Hypervisor, Citrix Virtual Apps and Desktops, Endpoint Management, NetScaler ADC, NetScaler Gateway, XenServer

CVE-2025-4945: A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when…

Affected

CVSS provenance