Summary
[3.6.5-20]
- CVE-2026-102557 libsoup3: libsoup: Heap buffer overflow during WebSocket
message reassembly
[3.6.5-19]
- CVE-2026-102556 libsoup3: libsoup: Heap buffer overflow from WebSocket
Pong signal type confusion
[3.6.5-18]
- CVE-2026-102558 libsoup3: libsoup: Heap buffer overflow during WebSocket
receive-buffer growth
[3.6.5-17]
- CVE-2026-102555 libsoup3: libsoup: Heap buffer overflow via uninitialized
length in data-URI base64 decoding
[3.6.5-16]
- CVE-2026-102560 libsoup3: libsoup: Heap buffer overflow during outgoing
permessage-deflate buffer growth
[3.6.5-15]
- CVE-2026-102559 libsoup3: libsoup: Heap buffer overflow during WebSocket
client-frame masking
[3.6.5-14]
- Fix CVE-2026-85197: http2 crash after connection destroyed
[3.6.5-13]
- Fix CVE-2026-15711: Reject oversized WebSocket control frames
[3.6.5-12]
- Fix CVE-2026-15709: bound decompressed WebSocket message size
[3.6.5-11]
- Add patches for CVE-2026-4271 and CVE-2026-5119
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | libsoup3 | 0:3.6.5-3.el10_2.20 |
| Oracle Linux · 10 | libsoup3-devel | 0:3.6.5-3.el10_2.20 |
| Oracle Linux · 10 | libsoup3-doc | 0:3.6.5-3.el10_2.20 |
Vulnerabilities 6
-
High 8.6
Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the do…
-
High 8.6
Libsoup: libsoup: heap buffer overflow during websocket message reassembly
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation …
-
High 8.6
Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame …
-
High 8.6
Libsoup: libsoup: heap buffer overflow during websocket client-frame masking
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer o…
-
High 8.6
Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap b…
-
High 8.2
Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length…