Y2
Public vulnerability disclosure

CVE-2026-102560

Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth

publishedCWE-125

A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.

Investigate in Cyber JSONMarkdown
Technical severity8.6 highCVSS 3.1 · CNA: redhat
Published2026-09-29Source updated 2026-11-02
Collected2026-11-022 attributed sources

Fixes and workarounds

Workaround

To mitigate this disable the permessage-deflate WebSocket extension if it is not required, and cap outgoing message sizes.

Source: CNA: redhat

Affected products and versions

ProductVersionsAuthority
Red Hat Enterprise Linux 10
Red Hat
libsoup3
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:3.6.5-3.el10_2.20; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9
Red Hat
libsoup
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:2.72.0-16.el9_8.8; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Red Hat
libsoup
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:2.72.0-8.el9_2.18; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Red Hat
libsoup
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:2.72.0-8.el9_4.17; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 6
Red Hat
libsoup
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unknown 		CNA: redhat
Red Hat Enterprise Linux 7
Red Hat
libsoup
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unaffected 		CNA: redhat
Red Hat Enterprise Linux 8
Red Hat
libsoup
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unaffected 		CNA: redhat

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

Version / scoreVectorAuthority
3.1 / 8.6
high		 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HCNA: redhat

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References