libsoup Use-After-Free Vulnerability in Content-Disposition Header Processing

A use-after-free vulnerability has been identified in the libsoup library, specifically in the function that retrieves content disposition headers. This vulnerability allows a malicious HTTP client to manipulate header values in a way that causes memory corruption on the server side. The issue arises from improper handling of the 'params' GHashTable value, leading to a double free condition. This vulnerability affects libsoup versions prior to 3.6.3.

Impact

Exploitation of this vulnerability can lead to memory corruption on the server, potentially allowing for arbitrary code execution or causing a denial-of-service condition.

Reproduction

To reproduce this vulnerability, send an HTTP request to a libsoup server with a crafted 'Content-Disposition' header that includes overlapping parameters. The server must be running a vulnerable version of libsoup, prior to 3.6.3.

Remediation

Users can upgrade to libsoup version 3.6.3 or later to address this vulnerability.