{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://gitlab.gnome.org/GNOME/libsoup","packageName":"libsoup","product":"libsoup","source":"CNA: redhat","vendor":"GNOME","versions":[{"lessThanOrEqual":"3.6.5","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libsoup3","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.6.5-3.el10_1.7","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libsoup3","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.6.5-3.el10_0.10","versionType":"rpm"}]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libsoup","product":"Red Hat Enterprise Linux 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libsoup","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libsoup","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libsoup","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2025-12105","cwes":["CWE-416"],"description":"A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-based applications to manage HTTP/2 communications. When network operations are aborted at specific timing intervals, an internal message queue item may be freed twice due to missing state synchronization. This leads to a use-after-free memory access, potentially crashing the affected application. Attackers could exploit this behavior remotely by triggering specific HTTP/2 read and cancel sequences, resulting in a denial-of-service condition.","epss":{"date":"2026-11-05","percentile":0.39748,"score":0.00456},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793888142177,"publishedAt":1761210854077,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2025:23139"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2025:23437"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2025-12105"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2405992"},{"source":"CNA: redhat","tags":[],"url":"https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/481"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to a widespread installation base, or stability."}],"revision":"df91087dfcfb231bcb15e4fd6203a1f9c06d2a3cc15d8bd29a393cc9c23936a5","sources":[{"modifiedAt":1793888142177,"name":"CNA: redhat","retrievedAt":1793891355024,"url":"https://www.cve.org/CVERecord?id=CVE-2025-12105"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793891363056,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-12105"}],"ssvc":{"assessedAt":1761231267920,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Libsoup: heap use-after-free in libsoup message queue handling during http/2 read completion","updatedAt":1793891363056}