Debian 11 bullseye: DLA-3992-1 critical: libsoup2.4 DoS & buffer overflow

CVE-2024-52530

In some configurations, HTTP request smuggling is possible because
null characters at the end of the names of HTTP headers were
ignored.

CVE-2024-52531

There was a buffer overflow in applications that perform conversion
to UTF-8 in soup_header_parse_param_list_strict. This could lead to
memory corruption, crashes or information disclosure.
(Contrary to the CVE description, it is now believed that input
received over the network could trigger this.)

CVE-2024-52532

An infinite loop in the processing of WebSocket data from clients
could lead to a denial-of-service problem through memory exhaustion.

For Debian 11 bullseye, these problems have been fixed in version
2.72.0-2+deb11u1.

We recommend that you upgrade your libsoup2.4 packages.

For the detailed security status of libsoup2.4 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/libsoup2.4