Summary
It was discovered that libsoup incorrectly handled certain WebSocket
frames. A remote attacker could possibly use this issue to cause an
application to crash or expose sensitive information. This issue only
affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu
26.10. (CVE-2026-12478)
It was discovered that libsoup incorrectly handled certain data URIs. A
remote attacker could possibly use this issue to cause an application to
crash or expose sensitive information. This issue only affected Ubuntu
22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.
(CVE-2026-102555)
It was discovered that libsoup incorrectly handled certain WebSocket
messages. A remote attacker could possibly use this issue to cause an
application to crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu
20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and
Ubuntu 26.10. (CVE-2026-102556)
It was discovered that libsoup incorrectly handled fragmented WebSocket
messages. A remote attacker could possibly use this issue to cause an
application to crash. (CVE-2026-102557)
It was discovered that libsoup incorrectly handled certain WebSocket
frames. A remote attacker could possibly use this issue to cause an
application to crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu
20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and
Ubuntu 26.10. (CVE-2026-102558)
It was discovered that libsoup incorrectly handled large WebSocket
messages. An attacker could possibly use this issue to cause an
application to crash. (CVE-2026-102559)
It was discovered that libsoup incorrectly handled compressed WebSocket
messages. An attacker could possibly use this issue to cause an
application to crash. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.
(CVE-2026-102560)
It was discovered that libsoup did not properly handle certain HTTP
requests. A remote attacker could possibly use this issue to inject
arbitrary HTTP requests. (CVE-2026-103399)
It was discovered that libsoup incorrectly handled proxy credentials. A
remote attacker could possibly use this issue to obtain sensitive
information. (CVE-2026-12547)
It was discovered that libsoup incorrectly handled multipart messages. A
remote attacker could possibly use this issue to cause an application to
crash or obtain sensitive information. (CVE-2026-12548)
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libsoup2.4 | 2.74.2-3ubuntu0.10 |
| Ubuntu · 24.04 LTS 24.04:LTS | libsoup2.4 | 2.74.3-6ubuntu1.10 |
| Ubuntu · 24.04 LTS 24.04:LTS | libsoup3 | 3.4.4-5ubuntu0.10 |
| Ubuntu · 26.04 LTS 26.04:LTS | libsoup3 | 3.6.6-1ubuntu0.2 |
| Ubuntu · 26.10 | libsoup3 | 3.6.6-1ubuntu3.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libsoup2.4 | 2.52.2-1ubuntu0.3+esm9 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libsoup2.4 | 2.62.1-1ubuntu0.4+esm10 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libsoup2.4 | 2.70.0-1ubuntu0.5+esm5 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | libsoup3 | 3.0.7-0ubuntu1+esm10 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | libsoup2.4 | 2.74.3-10.1ubuntu5+esm4 |
Vulnerabilities 10
-
High 8.6
Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the do…
-
High 8.6
Libsoup: libsoup: heap buffer overflow during websocket message reassembly
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation …
-
High 8.6
Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame …
-
High 8.6
Libsoup: libsoup: heap buffer overflow during websocket client-frame masking
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer o…
-
High 8.6
Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap b…
-
High 8.2
Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length…
-
Medium 5.3
Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body
A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes…
-
Medium 4.8CVE-2026-12478 Public exploit
Libsoup: incomplete fix for cve-2026-0716: out-of-bounds read in libsoup websocket frame processing (unmasked path)
The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload lengt…
-
Medium 4.2
Libsoup: heap out-of-bounds read in libsoup due to integer truncation
A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A r…
-
Low 3.4
Libsoup: information disclosure in libsoup via soupauthmanager proxy credential leak on proxy switch
SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to t…
References
-
report
https://ubuntu.com/security/CVE-2026-12478
-
report
https://ubuntu.com/security/CVE-2026-12547
-
report
https://ubuntu.com/security/CVE-2026-12548
-
report
https://ubuntu.com/security/CVE-2026-102555
-
report
https://ubuntu.com/security/CVE-2026-102556
-
report
https://ubuntu.com/security/CVE-2026-102557
-
report
https://ubuntu.com/security/CVE-2026-102558
-
report
https://ubuntu.com/security/CVE-2026-102559
-
report
https://ubuntu.com/security/CVE-2026-102560
-
report
https://ubuntu.com/security/CVE-2026-103399