Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream | libsoup | 0:2.72.0-8.el9_2.18 |
| Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream | libsoup-debuginfo | 0:2.72.0-8.el9_2.18 |
| Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream | libsoup-debugsource | 0:2.72.0-8.el9_2.18 |
| Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream | libsoup-devel | 0:2.72.0-8.el9_2.18 |
Vulnerabilities 5
-
High 8.6
Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the do…
-
High 8.6
Libsoup: libsoup: heap buffer overflow during websocket message reassembly
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation …
-
High 8.6
Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame …
-
High 8.6
Libsoup: libsoup: heap buffer overflow during websocket client-frame masking
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer o…
-
High 8.6
Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap b…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2543229
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2543231
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2543274
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2543285
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2543296
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_93447.json
-
report
https://access.redhat.com/security/cve/CVE-2026-102556
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-102556
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-102556
-
report
https://access.redhat.com/security/cve/CVE-2026-102557
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-102557
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-102557
-
report
https://access.redhat.com/security/cve/CVE-2026-102558
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-102558
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-102558
-
report
https://access.redhat.com/security/cve/CVE-2026-102559
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-102559
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-102559
-
report
https://access.redhat.com/security/cve/CVE-2026-102560
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-102560
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-102560