Introduction
Application crashes and denial-of-service events hurt right away when an organization depends on stable HTTP communication. CVE-2025-12105 is a recently discovered use-after-free vulnerability in libsoup. It directly affects a wide range of Linux systems and applications that use this core library for HTTP/2 support.
libsoup is the GNOME project's HTTP client and server library. GNOME desktop environments are built on it. WebKit-based browsers and many other Linux applications also use it. It ships in Red Hat Enterprise Linux (RHEL) versions 6 through 10 and in other major distributions, so a vulnerability in libsoup can reach both enterprise and consumer systems.
Technical Information
CVE-2025-12105 is a use-after-free vulnerability in the asynchronous message queue handling of libsoup's HTTP/2 implementation. The flaw appears when network operations are aborted at certain timing intervals, specifically HTTP/2 read operations. In those cases libsoup's internal state synchronization fails, and a message queue item can be freed twice. The double-free leads to a use-after-free memory access, which can crash the affected application.
The trigger is a race condition in the cleanup logic. When an HTTP/2 stream is canceled during an active read, one code path may deallocate the queue item while another still references it. That unsynchronized state produces undefined behavior, usually a segmentation fault or an application crash. Attackers can exploit this remotely by crafting HTTP/2 traffic that triggers the vulnerable sequence of read and cancel operations. The issue is classified under CWE-416 (Use After Free), a weakness class known to cause memory corruption and stability problems.
No public code snippets for the vulnerable logic have been released, but upstream bug trackers and Red Hat advisories confirm the flaw. It affects the asynchronous handling of HTTP/2 streams in libsoup, so it is relevant to any application or service that processes HTTP/2 traffic with this library.
Affected Systems and Versions
Red Hat advisories confirm that CVE-2025-12105 affects multiple versions of Red Hat Enterprise Linux: RHEL 6, 7, 8, 9, and 10. The vulnerability is present in the libsoup versions those RHEL releases use. For RHEL 10, the patched version is libsoup3 3.6.5-3.el10_0.7 or later. Other distributions and applications that use vulnerable libsoup releases for HTTP/2 communication are also potentially affected. The vulnerability matters for configurations where asynchronous HTTP/2 operations are enabled.
Vendor Security History
Red Hat has a strong track record of timely security advisories and coordinated patch releases. Several libsoup vulnerabilities have been addressed in 2025 alone, including integer underflow, heap buffer over-read, and out-of-bounds read issues. Red Hat's advisories are detailed, include SHA-256 checksums for package verification, and are released across all supported RHEL versions. The number of libsoup vulnerabilities in 2025 points to ongoing memory safety problems in the library, but Red Hat has responded promptly and systematically.
