Description
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High
Affected products
- GNOME / libsoup3.7.3
- RedHat / enterprise_linux7.0 – 7.0
- RedHat / enterprise_linux8.0 – 8.0
- RedHat / enterprise_linux9.0 – 9.0
- RedHat / enterprise_linux10.0 – 10.0
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:83384
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:83618
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:84586
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2026-102558
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2543274
Updated 30m ago · 8 sources