CVE-2025-32049: Libsoup: denial of service attack to websocket server
A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).
Other sources
Libsoup: denial of service attack to websocket server
— Microsoft
libsoup's SoupWebsocketConnection limits the size of incoming packets but not the size of WebSocket messages. A malicious peer may cause libsoup to allocate large amounts of memory by sending large messages consisting of many smaller packets.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32049?
CVE-2025-32049 is classified as a medium severity vulnerability.
How do I fix CVE-2025-32049?
To fix CVE-2025-32049, update libsoup to the latest version provided by your distribution.
What is the impact of CVE-2025-32049 on systems using libsoup?
CVE-2025-32049 may lead to a denial of service (DoS) due to large WebSocket messages causing excessive memory allocation.
Which versions of libsoup are affected by CVE-2025-32049?
CVE-2025-32049 affects all versions of libsoup prior to the patch addressing this vulnerability.
Is CVE-2025-32049 a network-related vulnerability?
Yes, CVE-2025-32049 is a network-related vulnerability as it involves the handling of WebSocket connections.