CVE-2025-4476 is a denial-of-service vulnerability in the libsoup HTTP client library, affecting applications that utilize it. The flaw allows an attacker to crash a client application by serving a specially crafted WWW-Authenticate header in a 401 HTTP response. This is a medium-severity vulnerability (CVSS 4.3) with a network attack vector and low complexity, requiring user interaction to connect to a malicious server. There is currently no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion beyond a single GitHub mention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | All Versions ImpactedCNA affecteddefault affected | |
| Red Hat | Red Hat Enterprise Linux 6 | Range not provided by sourceCNA affecteddefault unknown | |
| Red Hat | Red Hat Enterprise Linux 7 | Range not provided by sourceCNA affecteddefault unknown | |
| Red Hat | Red Hat Enterprise Linux 8 | All Versions ImpactedCNA affecteddefault affected | |
| Red Hat | Red Hat Enterprise Linux 9 | All Versions ImpactedCNA affecteddefault affected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.