CVE-2025-46420: libsoup2.4

CVSS: 6.5v3.1MediumDeferred

AliasesUBUNTU-CVE-2025-46420DEBIAN-CVE-2025-46420

Published 24-04-2025Last modified 25-07-2026

Vulnerability summary

CVE-2025-46420 is a medium (CVSS 6.5) vulnerability in libsoup2.4. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.8% of scored vulnerabilities.

Overall risk

26/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.58%

0%100%

Low · +0.02 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

24-04-2025
PublishedVulnerability first disclosed.
25-07-2026
Last modifiedVulnerability information updated.

Description

A flaw was found in libsoup. It is vulnerable to memory leaks in the soup_header_parse_quality_list() function when parsing a quality list that contains elements with all zeroes.

CVSS metrics

4 scores · 4 sources · 1 version

v3.16.5

EPSS trend

Probability

0.58%

Chance of exploitation in the next 30 days

Percentile

47%

Versus all other CVEs

30-day change

+0.02 pp

From 0.56% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.58%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected systems

Debian2 products

libsoup2.4All versions (No fix recorded) | < 2.74.3-10.1
libsoup3< 3.2.3-0+deb12u1 | < 3.6.4-1

Ubuntu2 products

libsoup2.4< 2.52.2-1ubuntu0.3+esm1 | < 2.62.1-1ubuntu0.4+esm2 | < 2.70.0-1ubuntu0.3 | < 2.74.2-3ubuntu0.3 | < 2.74.3-6ubuntu1.3
libsoup3< 3.0.7-0ubuntu1+esm3 | < 3.4.4-5ubuntu0.3

2 vendors · 4 products