CVE-2025-12105
Full vulnerability record from the local CVENow database.
Description
A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-based applications to manage HTTP/2 communications. When network operations are aborted at specific timing intervals, an internal message queue item may be freed twice due to missing state synchronization. This leads to a use-after-free memory access, potentially crashing the affected application. Attackers could exploit this behavior remotely by triggering specific HTTP/2 read and cancel sequences, resulting in a denial-of-service condition.
Severity
HIGH
CVSS score
7.5
(v3.1)
Vulnerability status
Deferred
Source identifier
Published
2025-10-23 10:15:32.043000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-12105",
"sourceIdentifier": "[email protected]",
"published": "2025-10-23T10:15:32.043",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-based applications to manage HTTP/2 communications. When network operations are aborted at specific timing intervals, an internal message queue item may be freed twice due to missing state synchronization. This leads to a use-after-free memory access, potentially crashing the affected application. Attackers could exploit this behavior remotely by triggering specific HTTP/2 read and cancel sequences, resulting in a denial-of-service condition."
},
{
"lang": "es",
"value": "Se encontró una vulnerabilidad en el manejo asíncrono de la cola de mensajes de la biblioteca libsoup, ampliamente utilizada por aplicaciones basadas en GNOME y WebKit para gestionar comunicaciones HTTP/2. Cuando las operaciones de red son abortadas en intervalos de tiempo específicos, un elemento interno de la cola de mensajes puede ser liberado dos veces debido a la falta de sincronización de estado. Esto conduce a un acceso a memoria de uso después de liberación, lo que podría provocar el bloqueo de la aplicación afectada. Los atacantes podrían explotar este comportamiento de forma remota al desencadenar secuencias específicas de lectura y cancelación de HTTP/2, lo que resultaría en una condición de denegación de servicio."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "GNOME",
"product": "libsoup",
"defaultStatus": "unaffected",
"collectionURL": "https://gitlab.gnome.org/GNOME/libsoup",
"packageName": "libsoup",
"versions": [
{
"version": "0",
"lessThanOrEqual": "3.6.5",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libsoup3",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.1"
],
"versions": [
{
"version": "0:3.6.5-3.el10_1.7",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libsoup3",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"versions": [
{
"version": "0:3.6.5-3.el10_0.10",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libsoup",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libsoup",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libsoup",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libsoup",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-23T14:54:27.920648Z",
"id": "CVE-2025-12105",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2025:23139",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:23437",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-12105",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2405992",
"source": "[email protected]"
},
{
"url": "https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/481",
"source": "[email protected]"
}
]
}