CVE-2026-102560
published 2026-09-29CVE-2026-102560: A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for…
PriorityP350critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.42%
35.2th percentile
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libsoup3 | — | — |
| gnome | libsoup | < 3.7.3 | 3.7.3 |
| gnome | libsoup | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth
vendor_redhat·2026-09-03·CVSS 8.6
CVE-2026-102560 [HIGH] CWE-125 libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth
libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
Statement: This issue is rated Important. Exploitation requires the permessage-deflate extension to be negotiated and a very large outgoing message to be compressed. Applications that enable WebSocket deflate with untrusted or unbounded message sizes are affected. Impact is heap corruption or denial of service.
Mitigation: To mitigate this disable the permessage-deflate WebSocket extension if it is not required, and cap outgoing m
GHSA
A flaw was found in libsoup.
ghsa_unreviewed·2026-09-29
CVE-2026-102560 [HIGH] CWE-125 A flaw was found in libsoup.
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-102560 libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102560 [HIGH] CVE-2026-102560 libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth
CVE-2026-102560 libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth
A heap buffer overflow was found in libsoup's WebSocket permessage-deflate outgoing path.
soup_websocket_extension_deflate_process_outgoing_message() stored deflateBound()'s uLong result in a guint and grew a GByteArray by that amount. For payloads approaching 4 GiB, the bound exceeds G_MAXUINT; truncation allowed buffer->len + max_length to wrap on later growth, and zlib wrote through next_out past the allocation.
Fixed by refusing payloads whose compressed bound cannot fit in a GByteArray and by checking each incremental growth (commit dbd0417e, libsoup 3.7.3).
References:
https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554 (Bug 8)
https://gitlab.gnome.org/GNOME/libsoup/-/commi
Bugzilla
CVE-2026-102560 mingw-libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth [fedora-all]
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102560 [HIGH] CVE-2026-102560 mingw-libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth [fedora-all]
CVE-2026-102560 mingw-libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap buffer overflow was found in libsoup's WebSocket permessage-deflate outgoing path.
soup_websocket_extension_deflate_process_outgoing_message() stored deflateBound()'s uLong result in a guint and grew a GByteArray by that amount. For payloads approaching 4 GiB, the bound exceeds G_MAXUINT; truncation allowed buffer->len + max_length to wrap on later growth, and zlib wrote through next_out past the allocation.
Fixed by refusing payloads who
Bugzilla
CVE-2026-102560 libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth [fedora-all]
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102560 [HIGH] CVE-2026-102560 libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth [fedora-all]
CVE-2026-102560 libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap buffer overflow was found in libsoup's WebSocket permessage-deflate outgoing path.
soup_websocket_extension_deflate_process_outgoing_message() stored deflateBound()'s uLong result in a guint and grew a GByteArray by that amount. For payloads approaching 4 GiB, the bound exceeds G_MAXUINT; truncation allowed buffer->len + max_length to wrap on later growth, and zlib wrote through next_out past the allocation.
Fixed by refusing payloads whose com
Bugzilla
CVE-2026-102560 libsoup3: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth [fedora-all]
bugzilla·2026-09-29·CVSS 8.6
CVE-2026-102560 [HIGH] CVE-2026-102560 libsoup3: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth [fedora-all]
CVE-2026-102560 libsoup3: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap buffer overflow was found in libsoup's WebSocket permessage-deflate outgoing path.
soup_websocket_extension_deflate_process_outgoing_message() stored deflateBound()'s uLong result in a guint and grew a GByteArray by that amount. For payloads approaching 4 GiB, the bound exceeds G_MAXUINT; truncation allowed buffer->len + max_length to wrap on later growth, and zlib wrote through next_out past the allocation.
Fixed by refusing payloads whose co
2026-09-29
Published