Back Linuxsecurity

Fedora 42: mingw-libsoup Critical Out-of-Bounds Read CVE-2025

Linuxsecurity •LinuxSecurity Advisories • December 23, 2025

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it). This is the MinGW build of Libsoup Update Information : Backport fix for CVE-2025-11021.

Libsoup is an HTTP library implementation in C. It was originally part

of a SOAP (Simple Object Access Protocol) implementation called Soup, but

the SOAP and non-SOAP parts have now been split into separate packages.

libsoup uses the Glib main loop and is designed to work well with GTK

applications. This enables GNOME applications to access HTTP servers

on the network in a completely asynchronous fashion, very similar to

the Gtk+ programming model (a synchronous operation mode is also

supported for those who want it).

This is the MinGW build of Libsoup

Backport fix for CVE-2025-11021.

* Sun Dec 14 2025 Sandro Mani - 2.74.3-14 - Backport fix for CVE-2025-11021 * Thu Jul 24 2025 Fedora Release Engineering - 2.74.3-13 - Rebuilt for

[ 1 ] Bug #2399631 - CVE-2025-11021 mingw-libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library [fedora-41] [ 2 ] Bug #2399634 - CVE-2025-11021 mingw-libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library [fedora-42]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-6c78aad721' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Out-of-Bounds Read Vulnerability in Libsoup for Fedora 42 and 43 A critical out-of-bounds read vulnerability has been identified in the mingw-libsoup library, affecting Fedora 42 and 43. This library, which facilitates HTTP communication for GNOME applications, is susceptible to exploitation, necessitating immediate security updates for users of these Fedora versions. 2 sources 34

Extracted Entities

CVEs (1)

CVE-2025-11021