CVE-2026-102559
published 2026-09-29CVE-2026-102559: A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation…
PriorityP349high8.6CVSS 3.1
AVNACLPRNUINSUCLILAH
EPSS
0.40%
33.5th percentile
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libsoup3 | — | — |
| gnome | libsoup | < 3.7.3 | 3.7.3 |
| gnome | libsoup | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
vendor_redhat8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking
vendor_redhat·2026-09-03·CVSS 8.6
CVE-2026-102559 [HIGH] CWE-125 libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking
libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
Statement: This issue is rated Important. Triggering requires causing a libsoup WebSocket client (or client-role connection) to send an extremely large message. That may be reachable when application-level message size is attacker-influenced. Impact is heap corruption or denial of service in the sending process.
Mitigation: To mitigate this enforce application-level limits on outgoing WebSocket message sizes. Do not send untrusted bulk data as a si
GHSA
A flaw was found in libsoup.
ghsa_unreviewed·2026-09-29
CVE-2026-102559 [HIGH] CWE-125 A flaw was found in libsoup.
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-102559 libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking [fedora-all]
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102559 [HIGH] CVE-2026-102559 libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking [fedora-all]
CVE-2026-102559 libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap buffer overflow was found in libsoup's client-side WebSocket frame construction / masking path.
Outgoing frames are built in a GByteArray. For a send payload larger than the array can represent (at/above ~2^31), g_byte_array_sized_new() / append truncated the length while xor_with_mask() still iterated the full attacker-/caller-controlled length, writing past the small allocation during masking.
Fixed by rejecting outgoing payloads above MAX_OUTGOING_PAYL
Bugzilla
CVE-2026-102559 libsoup3: libsoup: Heap buffer overflow during WebSocket client-frame masking [fedora-all]
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102559 [HIGH] CVE-2026-102559 libsoup3: libsoup: Heap buffer overflow during WebSocket client-frame masking [fedora-all]
CVE-2026-102559 libsoup3: libsoup: Heap buffer overflow during WebSocket client-frame masking [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap buffer overflow was found in libsoup's client-side WebSocket frame construction / masking path.
Outgoing frames are built in a GByteArray. For a send payload larger than the array can represent (at/above ~2^31), g_byte_array_sized_new() / append truncated the length while xor_with_mask() still iterated the full attacker-/caller-controlled length, writing past the small allocation during masking.
Fixed by rejecting outgoing payloads above MAX_OUTGOING_PAY
Bugzilla
CVE-2026-102559 mingw-libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking [fedora-all]
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102559 [HIGH] CVE-2026-102559 mingw-libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking [fedora-all]
CVE-2026-102559 mingw-libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap buffer overflow was found in libsoup's client-side WebSocket frame construction / masking path.
Outgoing frames are built in a GByteArray. For a send payload larger than the array can represent (at/above ~2^31), g_byte_array_sized_new() / append truncated the length while xor_with_mask() still iterated the full attacker-/caller-controlled length, writing past the small allocation during masking.
Fixed by rejecting outgoing payloads above MAX_OUTGOIN
Bugzilla
CVE-2026-102559 libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102559 [HIGH] CVE-2026-102559 libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking
CVE-2026-102559 libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking
A heap buffer overflow was found in libsoup's client-side WebSocket frame construction / masking path.
Outgoing frames are built in a GByteArray. For a send payload larger than the array can represent (at/above ~2^31), g_byte_array_sized_new() / append truncated the length while xor_with_mask() still iterated the full attacker-/caller-controlled length, writing past the small allocation during masking.
Fixed by rejecting outgoing payloads above MAX_OUTGOING_PAYLOAD_SIZE both before and after extensions process the payload (commit d7f074f8, libsoup 3.7.3).
References:
https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554 (Bug 7)
https://gitlab.gnome.org/GNOME/libsoup/-/commit/d7f074f8
2026-09-29
Published