Red Hat Security Advisory: libsoup security update

Fixed packages 3

Vulnerabilities 4

• High 8.6
  CVE-2026-102556

  Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion

  A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the do…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Sep 29, 2026
• High 8.6
  CVE-2026-102557

  Libsoup: libsoup: heap buffer overflow during websocket message reassembly

  A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Sep 29, 2026
• High 8.6
  CVE-2026-102558

  Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth

  A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Sep 29, 2026
• High 8.6
  CVE-2026-102559

  Libsoup: libsoup: heap buffer overflow during websocket client-frame masking

  A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer o…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Sep 29, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2543229
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2543231
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2543274
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2543285
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_93465.json
• report
  https://access.redhat.com/security/cve/CVE-2026-102556
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-102556
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-102556
• report
  https://access.redhat.com/security/cve/CVE-2026-102557
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-102557
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-102557
• report
  https://access.redhat.com/security/cve/CVE-2026-102558
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-102558
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-102558
• report
  https://access.redhat.com/security/cve/CVE-2026-102559
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-102559
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-102559