Debian LTS: DLA-4398-1 libsoup2.4 Denial-of-Service CVE-2025-4476

CVE-2025-4476

A denial-of-service vulnerability has been identified in the libsoup
HTTP client library. This flaw can be triggered when a libsoup client
receives a 401 (Unauthorized) HTTP response containing a specifically
crafted domain parameter within the WWW-Authenticate header. Processing
this malformed header can lead to a crash of the client application
using libsoup. An attacker could exploit this by setting up a malicious
HTTP server. If a user's application using the vulnerable libsoup
library connects to this malicious server, it could result in a
denial-of-service. Successful exploitation requires tricking a user's
client application into connecting to the attacker's malicious server.

CVE-2025-4945

A flaw was found in the cookie parsing logic of the libsoup HTTP
library, used in GNOME applications and other software. The
vulnerability arises when processing the expiration date of cookies,