CVE-2026-102558
published 2026-09-29CVE-2026-102558: A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an…
PriorityP349high8.6CVSS 3.1
AVNACLPRNUINSUCLILAH
EPSS
0.39%
32.3th percentile
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libsoup3 | — | — |
| gnome | libsoup | < 3.7.3 | 3.7.3 |
| gnome | libsoup | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
vendor_redhat8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in libsoup.
ghsa_unreviewed·2026-09-29
CVE-2026-102558 [HIGH] CWE-125 A flaw was found in libsoup.
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.
Red Hat
libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth
vendor_redhat·2026-09-03·CVSS 8.6
CVE-2026-102558 [HIGH] CWE-125 libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth
libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.
Statement: This issue is rated Important. A remote WebSocket peer can cause heap corruption or denial of service, especially when applications leave incoming payload size unlimited. Default configurations that set a finite max-incoming-payload-size reduce exposure but the vulnerable code path remains relevant for applications that disable the limit.
Mitigation: To mitigate this configure a finite max-incoming-payload-size (do not set it to 0/unlimite
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-102558 libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102558 [HIGH] CVE-2026-102558 libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth
CVE-2026-102558 libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth
A heap buffer overflow was found in libsoup's WebSocket incoming receive buffer handling.
Incoming frames are accumulated in a GByteArray. With max-incoming-payload-size set to 0 (unlimited), a peer could declare a multi-GiB payload and stream it until the buffer length wrapped in g_byte_array_set_size() while the read still targeted the original offset, writing past the allocation.
Fixed by rejecting payload lengths above what the receive buffer can represent as soon as the frame header is parsed, before buffering the payload (commit 381a474f, libsoup 3.7.3). Such frames are closed as SOUP_WEBSOCKET_CLOSE_TOO_BIG.
References:
https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554 (Bug 6)
htt
Bugzilla
CVE-2026-102558 mingw-libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth [fedora-all]
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102558 [HIGH] CVE-2026-102558 mingw-libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth [fedora-all]
CVE-2026-102558 mingw-libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap buffer overflow was found in libsoup's WebSocket incoming receive buffer handling.
Incoming frames are accumulated in a GByteArray. With max-incoming-payload-size set to 0 (unlimited), a peer could declare a multi-GiB payload and stream it until the buffer length wrapped in g_byte_array_set_size() while the read still targeted the original offset, writing past the allocation.
Fixed by rejecting payload lengths above what the receive buffer can repr
Bugzilla
CVE-2026-102558 libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth [fedora-all]
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102558 [HIGH] CVE-2026-102558 libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth [fedora-all]
CVE-2026-102558 libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap buffer overflow was found in libsoup's WebSocket incoming receive buffer handling.
Incoming frames are accumulated in a GByteArray. With max-incoming-payload-size set to 0 (unlimited), a peer could declare a multi-GiB payload and stream it until the buffer length wrapped in g_byte_array_set_size() while the read still targeted the original offset, writing past the allocation.
Fixed by rejecting payload lengths above what the receive buffer can represent
Bugzilla
CVE-2026-102558 libsoup3: libsoup: Heap buffer overflow during WebSocket receive-buffer growth [fedora-all]
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102558 [HIGH] CVE-2026-102558 libsoup3: libsoup: Heap buffer overflow during WebSocket receive-buffer growth [fedora-all]
CVE-2026-102558 libsoup3: libsoup: Heap buffer overflow during WebSocket receive-buffer growth [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap buffer overflow was found in libsoup's WebSocket incoming receive buffer handling.
Incoming frames are accumulated in a GByteArray. With max-incoming-payload-size set to 0 (unlimited), a peer could declare a multi-GiB payload and stream it until the buffer length wrapped in g_byte_array_set_size() while the read still targeted the original offset, writing past the allocation.
Fixed by rejecting payload lengths above what the receive buffer can represent
2026-09-29
Published