DLA-3992-1

Multiple vulnerabilities were discovered in libsoup2.4, an HTTP library for Gtk+ programs.

CVE-2024-52530

In some configurations, HTTP request smuggling is possible because
null characters at the end of the names of HTTP headers were
ignored.

CVE-2024-52531

There was a buffer overflow in applications that perform conversion
to UTF-8 in soup_header_parse_param_list_strict.  This could lead to
memory corruption, crashes or information disclosure.
(Contrary to the CVE description, it is now believed that input
received over the network could trigger this.)

CVE-2024-52532

An infinite loop in the processing of WebSocket data from clients
could lead to a denial-of-service problem through memory exhaustion.