CVE-2025-4476 Details

A denial-of-service vulnerability exists in the libsoup HTTP client library. This issue arises when a libsoup client processes a 401 (Unauthorized) HTTP response that contains a specially crafted domain parameter in the WWW-Authenticate header. The improper handling of this malformed header can cause the client application to crash. An attacker could exploit this vulnerability by setting up a malicious HTTP server. If a user's application, which uses the vulnerable version of libsoup, connects to this server, it could lead to a denial-of-service condition. Exploitation requires deceiving the user into connecting to the attacker's server.

Red Hat advises against connecting applications that use libsoup to untrusted HTTP servers until an update is available. Users can check the Red Hat Product Security page for errata notifications and support options.