CVE-2025-46420

MediumCVSS 6.5/10Last modified Nov 5, 2026

Description

A flaw was found in libsoup. It is vulnerable to memory leaks in the soup_header_parse_quality_list() function when parsing a quality list that contains elements with all zeroes.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

VendorProductVersions
——< 3.6.3
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—

References

Timeline

Published
Apr 24, 2025
Last modified
Nov 5, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-464216.8A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new CVE-2025-464227.8Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionCVE-2025-464237.8Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionCVE-2025-464244.4Dell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky Implementation vulnerability. A high privilegedCVE-2025-464256.5Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerabCVE-2025-464278.8Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('CommaCVE-2025-464288.8Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('CommCVE-2025-46436.3Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or inteCVE-2025-464307.3Dell Display and Peripheral Manager, versions prior to 2.1.2.12, contains an Execution with Unnecessary Privileges vulnerability in the InstCVE-2025-464326.5In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logsCVE-2025-464339.8In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possibleCVE-2025-464346.5Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro theplus_elementor_addon allows Exploiting Incor
CVE-2025-46420: Medium severity, CVSS 6.5 | Vulnix