CVEFinder.io

CVE-2025-2784

⚠ī¸ high
🔍 Scan for this CVE
Summary

A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.

CVSS Score
7.0
High
EPSS Score
0.7
Exploit Probability
Published Date
2025-04-03
First Seen: 2026-01-05
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 51.8% of all 330,193 vulnerabilities in our database.

#158,994
Above average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: Apr 3, 2025
🔍 Exploitation Status
Poc
Proof-of-concept available
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-06-25
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
CWE IDs (Weakness Types)
CWE-125

đŸ“Ļ Affected Products 57

Vendor Product Status Affected Versions
redhat enterprise_linux Affected
v10.0
redhat enterprise_linux Affected
v8.0
redhat enterprise_linux Affected
v9.0
redhat enterprise_linux_server Affected
v7.0
redhat enterprise_linux_for_power_little_endian Affected
v10.0_ppc64le
redhat enterprise_linux_for_power_little_endian Affected
v8.0_ppc64le
redhat enterprise_linux_for_power_little_endian Affected
v9.0_ppc64le
redhat enterprise_linux_for_ibm_z_systems Affected
v10.0_s390x
redhat enterprise_linux_for_ibm_z_systems Affected
v8.0_s390x
redhat enterprise_linux_for_ibm_z_systems Affected
v9.0_s390x
redhat enterprise_linux_for_power_little_endian_eus Affected
v10.0_ppc64le
redhat enterprise_linux_for_power_little_endian_eus Affected
v8.8_ppc64le
redhat enterprise_linux_for_power_little_endian_eus Affected
v9.2_ppc64le
redhat enterprise_linux_for_power_little_endian_eus Affected
v9.4_ppc64le
redhat enterprise_linux_for_power_little_endian_eus Affected
v9.6_ppc64le
redhat enterprise_linux_for_ibm_z_systems_eus Affected
v10.0_s390x
redhat enterprise_linux_for_ibm_z_systems_eus Affected
v8.8_s390x
redhat enterprise_linux_for_ibm_z_systems_eus Affected
v9.2_s390x
redhat enterprise_linux_for_ibm_z_systems_eus Affected
v9.4_s390x
redhat enterprise_linux_for_ibm_z_systems_eus Affected
v9.6_s390x
redhat enterprise_linux_server_tus Affected
v8.6
redhat enterprise_linux_server_tus Affected
v8.8
redhat enterprise_linux_eus Affected
v10.0
redhat enterprise_linux_eus Affected
v8.8
redhat enterprise_linux_eus Affected
v9.2
redhat enterprise_linux_eus Affected
v9.4
redhat enterprise_linux_eus Affected
v9.6
redhat enterprise_linux_server_aus Affected
v8.2
redhat enterprise_linux_server_aus Affected
v8.4
redhat enterprise_linux_server_aus Affected
v8.6
redhat enterprise_linux_server_aus Affected
v9.2
redhat enterprise_linux_server_aus Affected
v9.4
redhat enterprise_linux_server_aus Affected
v9.6
gnome libsoup Affected
< 3.6.5
redhat enterprise_linux_update_services_for_sap_solutions Affected
v8.8
redhat enterprise_linux_update_services_for_sap_solutions Affected
v9.0
redhat enterprise_linux_update_services_for_sap_solutions Affected
v9.2
redhat enterprise_linux_update_services_for_sap_solutions Affected
v9.4
redhat enterprise_linux_update_services_for_sap_solutions Affected
v9.6
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions Affected
v8.6_ppc64le
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions Affected
v9.0_ppc64le
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions Affected
v9.6_ppc64le
redhat codeready_linux_builder Affected
v10.0
redhat codeready_linux_builder_for_ibm_z_systems Affected
v10.0_s390x
redhat codeready_linux_builder_for_power_little_endian Affected
v10.0_ppc64le
redhat codeready_linux_builder_for_power_little_endian_eus Affected
v10.0_ppc64le
redhat codeready_linux_builder_for_arm64_eus Affected
v10.0_aarch64
redhat codeready_linux_builder_for_ibm_z_systems_eus Affected
v10.0_s390x
redhat enterprise_linux_for_arm_64 Affected
v10.0_aarch64
redhat enterprise_linux_for_arm_64 Affected
v8.0_aarch64
redhat enterprise_linux_for_arm_64 Affected
v9.0_aarch64
redhat enterprise_linux_for_arm_64_eus Affected
v10.0_aarch64
redhat enterprise_linux_for_arm_64_eus Affected
v8.8_aarch64
redhat enterprise_linux_for_arm_64_eus Affected
v9.2_aarch64
redhat enterprise_linux_for_arm_64_eus Affected
v9.4_aarch64
redhat enterprise_linux_for_arm_64_eus Affected
v9.6_aarch64
redhat codeready_linux_builder_for_arm64 Affected
v10.0_aarch64

🔗 References 16

https://access.redhat.com/errata/RHSA-2025:21657
https://access.redhat.com/errata/RHSA-2025:7505
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:8126
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:8132
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:8139
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:8140
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:8252
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:8480
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:8481
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:8482
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:8663
Third Party Advisory
https://access.redhat.com/errata/RHSA-2025:9179
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2025-2784
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2354669
Third Party Advisory
https://gitlab.gnome.org/GNOME/libsoup/-/issues/422
Exploit Issue Tracking
https://lists.debian.org/debian-lts-announce/2025/04...

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-55653 đŸ”ļ medium 4.3 0.2 A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group ... 2026-06-23
CVE-2026-55654 ℹī¸ low 3.7 0.3 A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic... 2026-06-23
CVE-2026-55655 đŸ”ļ medium 5.0 0.1 A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding ... 2026-06-23
CVE-2026-11791 đŸ”ļ medium 5.0 0.3 A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function unconditionally frees... 2026-06-18
CVE-2026-1764 đŸ”ļ medium 5.6 0.2 A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially craf... 2026-06-16
CVE-2026-1766 đŸ”ļ medium 5.6 0.2 A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracke... 2026-06-16
These CVEs affect the same products