ALAS2023-2025-961

A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. (CVE-2025-32907)

A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS). (CVE-2025-32908)

A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds. (CVE-2025-32914)

aarch64:
    libsoup3-debuginfo-3.6.5-48.amzn2023.aarch64
    libsoup3-3.6.5-48.amzn2023.aarch64
    libsoup3-devel-3.6.5-48.amzn2023.aarch64
    libsoup3-debugsource-3.6.5-48.amzn2023.aarch64

noarch:
    libsoup3-doc-3.6.5-48.amzn2023.noarch

src:
    libsoup3-3.6.5-48.amzn2023.src

x86_64:
    libsoup3-debuginfo-3.6.5-48.amzn2023.x86_64
    libsoup3-debugsource-3.6.5-48.amzn2023.x86_64
    libsoup3-devel-3.6.5-48.amzn2023.x86_64
    libsoup3-3.6.5-48.amzn2023.x86_64