CVE-2026-102557
published 2026-09-29CVE-2026-102557: A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the…
PriorityP348high8.6CVSS 3.1
AVNACLPRNUINSUCLILAH
EPSS
0.27%
19.6th percentile
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libsoup3 | — | — |
| gnome | libsoup | < 3.7.3 | 3.7.3 |
| gnome | libsoup | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
vendor_redhat8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in libsoup.
ghsa_unreviewed·2026-09-29
CVE-2026-102557 [HIGH] CWE-125 A flaw was found in libsoup.
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.
Red Hat
libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly
vendor_redhat·2026-09-03·CVSS 8.6
CVE-2026-102557 [HIGH] CWE-125 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly
libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.
Statement: This issue is rated Important. A remote, unauthenticated WebSocket peer can trigger heap corruption or denial of service during message reassembly. Any Red Hat product or application exposing or consuming libsoup WebSockets with untrusted peers is affected until updated.
Mitigation: To mitigate this set a conservative max-total-incoming-message-size / incomi
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-102557 mingw-libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly [fedora-all]
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102557 [HIGH] CVE-2026-102557 mingw-libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly [fedora-all]
CVE-2026-102557 mingw-libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap buffer overflow was found in libsoup WebSocket fragmented-message reassembly.
Reassembled messages are stored in a GByteArray (length typed as guint). A sequence of fragments (or extension expansion) that grew the message past G_MAXINT caused g_byte_array_set_size() / related growth APIs to truncate the size while surrounding code continued to use the full length, corrupting the heap. Upstream notes interaction with older GLib (e.g. 2.70) growth behavi
Bugzilla
CVE-2026-102557 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102557 [HIGH] CVE-2026-102557 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly
CVE-2026-102557 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly
A heap buffer overflow was found in libsoup WebSocket fragmented-message reassembly.
Reassembled messages are stored in a GByteArray (length typed as guint). A sequence of fragments (or extension expansion) that grew the message past G_MAXINT caused g_byte_array_set_size() / related growth APIs to truncate the size while surrounding code continued to use the full length, corrupting the heap. Upstream notes interaction with older GLib (e.g. 2.70) growth behavior.
Fixed by rejecting reassembly that would exceed what a GByteArray can safely hold, independently of max-total-message-size (commit d7f074f8, libsoup 3.7.3).
References:
https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554 (Bug 5)
https
Bugzilla
CVE-2026-102557 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly [fedora-all]
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102557 [HIGH] CVE-2026-102557 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly [fedora-all]
CVE-2026-102557 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap buffer overflow was found in libsoup WebSocket fragmented-message reassembly.
Reassembled messages are stored in a GByteArray (length typed as guint). A sequence of fragments (or extension expansion) that grew the message past G_MAXINT caused g_byte_array_set_size() / related growth APIs to truncate the size while surrounding code continued to use the full length, corrupting the heap. Upstream notes interaction with older GLib (e.g. 2.70) growth behavior.
F
Bugzilla
CVE-2026-102557 libsoup3: libsoup: Heap buffer overflow during WebSocket message reassembly [fedora-all]
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102557 [HIGH] CVE-2026-102557 libsoup3: libsoup: Heap buffer overflow during WebSocket message reassembly [fedora-all]
CVE-2026-102557 libsoup3: libsoup: Heap buffer overflow during WebSocket message reassembly [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap buffer overflow was found in libsoup WebSocket fragmented-message reassembly.
Reassembled messages are stored in a GByteArray (length typed as guint). A sequence of fragments (or extension expansion) that grew the message past G_MAXINT caused g_byte_array_set_size() / related growth APIs to truncate the size while surrounding code continued to use the full length, corrupting the heap. Upstream notes interaction with older GLib (e.g. 2.70) growth behavior.
2026-09-29
Published