Y2
Public vulnerability disclosure

CVE-2026-102558

Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth

publishedCWE-125

A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.

Investigate in Cyber JSONMarkdown
Technical severity8.6 highCVSS 3.1 · CNA: redhat
Published2026-09-29Source updated 2026-11-02
Collected2026-11-022 attributed sources

Fixes and workarounds

Workaround

To mitigate this configure a finite max-incoming-payload-size (do not set it to 0/unlimited) on SoupWebsocketConnection. Restrict WebSocket exposure to trusted peers.

Source: CNA: redhat

Affected products and versions

ProductVersionsAuthority
Red Hat Enterprise Linux 10
Red Hat
libsoup3
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:3.6.5-3.el10_2.20; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 8
Red Hat
libsoup
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:2.62.3-19.el8_10; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Red Hat
libsoup
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:2.62.3-2.el8_4.14; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Red Hat
libsoup
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:2.62.3-2.el8_4.14; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Red Hat
libsoup
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:2.62.3-3.el8_8.15; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Red Hat
libsoup
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:2.62.3-3.el8_8.15; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9
Red Hat
libsoup
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:2.72.0-16.el9_8.8; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Red Hat
libsoup
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:2.72.0-8.el9_2.18; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Red Hat
libsoup
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:2.72.0-8.el9_4.17; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 6
Red Hat
libsoup
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unknown 		CNA: redhat
Red Hat Enterprise Linux 7
Red Hat
libsoup
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

Version / scoreVectorAuthority
3.1 / 8.6
high		 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HCNA: redhat

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References