The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fce2f41203 advisory.

    Fixes lots of CVEs: see the fixes section for details

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2025:1753131065 advisory.

  - A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content     via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to     a crafted HTTP response by an HTTP server. (CVE-2025-2784)

  - A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug     resulting in a buffer under-read. (CVE-2025-32050)

  - A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-     read. (CVE-2025-32052)

  - A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space()     functions may lead to a heap buffer over-read. (CVE-2025-32053)

  - A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource     consumption attack. This flaw allows a malicious client to request the same range many times in a single     HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of     service. (CVE-2025-32907)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751133871 advisory.

  - A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource     consumption attack. This flaw allows a malicious client to request the same range many times in a single     HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of     service. (CVE-2025-32907)

  - A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the     HTTP Authorization header to the new host that the redirection points to. This allows the new host to     impersonate the user to the original host that issued the redirect. (CVE-2025-46421)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has libsoup packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a     zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access     sensitive information or cause an application level denial of service. (CVE-2026-2369)

  - GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at     the end of header names are ignored, i.e., a Transfer-Encoding\0: chunked header is treated the same as     a Transfer-Encoding: chunked header. (CVE-2024-52530)

  - A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and     other applications for web communication. When processing cookies with specially crafted expiration dates,     the library may perform an out-of-bounds memory read. This flaw could result in unintended disclosure of     memory contents, potentially exposing sensitive information from the process using libsoup.
    (CVE-2025-11021)

  - A flaw in libsoup's HTTP header handling allows multiple Host: headers in a request and returns the last     occurrence for server-side processing. Common front proxies often honor the first Host: header, so this     mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend     interprets it as destined for another host. This discrepancy enables request-smuggling style attacks,     cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.
    (CVE-2025-14523)

  - A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content     via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to     a crafted HTTP response by an HTTP server. (CVE-2025-2784)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource     consumption attack. This flaw allows a malicious client to request the same range many times in a single     HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of     service. (CVE-2025-32907)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
344486	Fedora 43 : libsoup3 (2026-fce2f41203)	Nessus	Fedora Local Security Checks	2026/9/10	2026/9/10	medium
359579	CentOS Linux 7 [TuxCare] Security Update: libsoup / libsoup-devel Multiple Vulnerabilities (CENTOS7:CLSA-2025:1753131065)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	medium
361402	AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1751133871)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	medium
343555	NewStart CGSL MAIN 7.02 : libsoup Multiple Vulnerabilities (NS-SA-2026-0100)	Nessus	NewStart CGSL Local Security Checks	2026/9/8	2026/9/8	high
244489	Linux Distros Unpatched Vulnerability : CVE-2025-32907	Nessus	Misc.	2025/8/6	2026/9/2	medium

検出

プラグインの検索

medium

medium

medium

high

medium