CVE-2026-102556
published 2026-09-29CVE-2026-102556: A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even…
PriorityP347high8.6CVSS 3.1
AVNACLPRNUINSUCLILAH
EPSS
0.27%
18.7th percentile
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libsoup3 | — | — |
| gnome | libsoup | < 3.7.3 | 3.7.3 |
| gnome | libsoup | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
vendor_redhat8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion
vendor_redhat·2026-09-03·CVSS 8.6
CVE-2026-102556 [HIGH] CWE-843 libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion
libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.
Statement: This issue is rated Important. A remote peer can send a WebSocket Pong that reaches receive_pong(). Exploitation requires an application to connect a ::pong handler that expects GBytes; many keep-alive users do. Successful triggering can crash the process or corrupt heap state. libsoup WebSocket support is used by client and server applications on Red Hat
GHSA
A flaw was found in libsoup.
ghsa_unreviewed·2026-09-29
CVE-2026-102556 [HIGH] CWE-843 A flaw was found in libsoup.
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-102556 libsoup3: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion [fedora-all]
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102556 [HIGH] CVE-2026-102556 libsoup3: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion [fedora-all]
CVE-2026-102556 libsoup3: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A type-confusion heap overflow was found in libsoup's WebSocket Pong handling.
SoupWebsocketConnection::pong is declared to deliver a GBytes payload, but receive_pong() emitted a GByteArray pointer via g_signal_emit() and then unreffed the GByteArray. Handlers that treated the argument as GBytes (as documented) operated on the wrong object layout, resulting in heap memory corruption / overflow conditions under ASan.
Fixed upstream by converting the buffer w
Bugzilla
CVE-2026-102556 mingw-libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion [fedora-all]
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102556 [HIGH] CVE-2026-102556 mingw-libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion [fedora-all]
CVE-2026-102556 mingw-libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A type-confusion heap overflow was found in libsoup's WebSocket Pong handling.
SoupWebsocketConnection::pong is declared to deliver a GBytes payload, but receive_pong() emitted a GByteArray pointer via g_signal_emit() and then unreffed the GByteArray. Handlers that treated the argument as GBytes (as documented) operated on the wrong object layout, resulting in heap memory corruption / overflow conditions under ASan.
Fixed upstream by converting the buf
Bugzilla
CVE-2026-102556 libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion [fedora-all]
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102556 [HIGH] CVE-2026-102556 libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion [fedora-all]
CVE-2026-102556 libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A type-confusion heap overflow was found in libsoup's WebSocket Pong handling.
SoupWebsocketConnection::pong is declared to deliver a GBytes payload, but receive_pong() emitted a GByteArray pointer via g_signal_emit() and then unreffed the GByteArray. Handlers that treated the argument as GBytes (as documented) operated on the wrong object layout, resulting in heap memory corruption / overflow conditions under ASan.
Fixed upstream by converting the buffer wi
Bugzilla
CVE-2026-102556 libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102556 [HIGH] CVE-2026-102556 libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion
CVE-2026-102556 libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion
A type-confusion heap overflow was found in libsoup's WebSocket Pong handling.
SoupWebsocketConnection::pong is declared to deliver a GBytes payload, but receive_pong() emitted a GByteArray pointer via g_signal_emit() and then unreffed the GByteArray. Handlers that treated the argument as GBytes (as documented) operated on the wrong object layout, resulting in heap memory corruption / overflow conditions under ASan.
Fixed upstream by converting the buffer with g_byte_array_free_to_bytes() before emission (commit d2cbaf25, libsoup 3.7.3).
References:
https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554 (Bug 2)
https://gitlab.gnome.org/GNOME/libsoup/-/commit/d2cbaf25
2026-09-29
Published