7

CVE-2025-2784: gnome libsoup Out-of-bounds Read

CVSS: 7.0v3.1HighModified
AliasesUBUNTU-CVE-2025-2784DEBIAN-CVE-2025-2784
Published 03-04-2025Last modified 30-06-2026
Open JSON

Vulnerability summary

CVE-2025-2784 is a high (CVSS 7.0) Out-of-bounds Read vulnerability in gnome libsoup. EPSS estimates a 0.86% chance of exploitation in the next 30 days, higher than 57.7% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
38/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.0/10
010
High · v3.1 (CVE.org)
EPSS score
0.86%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 27 · Related 13
DLA-4140-1MGASA-2025-0261OPENSUSE-SU-2025:15018-1RHSA-2025:21657RHSA-2025:7505RHSA-2025:8126

Timeline

  1. 03-04-2025
    PublishedVulnerability first disclosed.
  2. 30-06-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.86%

Chance of exploitation in the next 30 days

Percentile

58%

Versus all other CVEs

30-day change

+0.02 pp

From 0.84% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.86%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (gitlab.gnome.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Redhat20 products
Debian2 products
  • libsoup2.4All versions (No fix recorded) | < 2.74.3-10
  • libsoup3< 3.2.3-0+deb12u1 | < 3.6.5-1
Ubuntu2 products
  • libsoup2.4< 2.52.2-1ubuntu0.3+esm4 | < 2.62.1-1ubuntu0.4+esm5 | < 2.70.0-1ubuntu0.2 | < 2.74.2-3ubuntu0.2 | < 2.74.3-6ubuntu1.2
  • libsoup3< 3.0.7-0ubuntu1+esm2 | < 3.4.4-5ubuntu0.2
Gnome1 product

4 vendors · 25 products

References

22 links
Show all 22 references