Libsoup's Double-Free Disaster: Analyzing CVE-2025-32911's Critical Memory Corruption Flaw
Introduction
A critical double-free vulnerability (CVE-2025-32911) has emerged in libsoup, a widely used HTTP library integral to Linux ecosystems. This flaw, residing in the header parsing mechanism, can lead to severe memory corruption, potentially enabling attackers to execute arbitrary code or cause denial of service. With a CVSS score of 9.0, this vulnerability demands immediate attention from security professionals and system administrators.
Affected Systems and Versions
The vulnerability specifically affects libsoup implementations utilizing the soup_message_headers_get_content_disposition() function. Red Hat Enterprise Linux (RHEL) versions 6 through 9 are confirmed vulnerable. Other Linux distributions leveraging libsoup, such as Ubuntu and Fedora, may also be impacted, pending vendor confirmation.
Technical Information
The vulnerability stems from improper memory management in the soup_message_headers_get_content_disposition() function. Malicious HTTP headers containing duplicate parameters can trigger a double-free scenario, causing memory corruption.
Vulnerable Code Snippet
gboolean soup_message_headers_get_content_disposition (SoupMessageHeaders *hdrs, char **disposition, GHashTable **params) {
// ...
if (params)
*params = g_hash_table_new_full (/* ... */); // First allocation
// ...
if (parse_content_disposition (/* ... */)) {
// ...
g_hash_table_unref (*params); // First free
}
// ...
g_hash_table_unref (*params); // Second free (double-free)
}Attack Vectors
Attackers can exploit this flaw by sending crafted HTTP requests to vulnerable servers or malicious responses to clients, causing memory corruption and potential remote code execution.
Proof of Concept
Currently, a detailed proof-of-concept exploit is not publicly available. However, fuzzing tests using AFL++ have successfully demonstrated reproducible crashes, confirming exploitability.
Patch Information
As of now, no official patches or mitigations have been released by Red Hat or other vendors. Users should closely monitor vendor advisories for updates.
Detection Methods
Specific detection methods or indicators of compromise have not been publicly disclosed. Organizations should monitor logs for abnormal HTTP header patterns and memory corruption errors.
Vendor Security History
Libsoup has previously faced multiple memory-related vulnerabilities, indicating ongoing challenges in secure memory management practices within the library. Red Hat and other vendors have historically responded promptly to critical vulnerabilities, though delays in patch availability remain a concern.
References
Security teams should prioritize immediate mitigation strategies and remain vigilant for vendor updates addressing this critical vulnerability.
