Описание
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.
Отчет
This issue is rated Important. A remote, unauthenticated WebSocket peer can trigger heap corruption or denial of service during message reassembly. Any Red Hat product or application exposing or consuming libsoup WebSockets with untrusted peers is affected until updated.
Меры по смягчению последствий
To mitigate this set a conservative max-total-incoming-message-size / incoming payload limits where the API allows, and do not accept WebSocket connections from untrusted peers.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | libsoup | Out of support scope | ||
| Red Hat Enterprise Linux 10 | libsoup3 | Fixed | RHSA-2026:83618 | 15.10.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | libsoup3 | Fixed | RHSA-2026:93583 | 02.11.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | libsoup | Fixed | RHSA-2026:93465 | 02.11.2026 |
| Red Hat Enterprise Linux 8 | libsoup | Fixed | RHSA-2026:84586 | 19.10.2026 |
| Red Hat Enterprise Linux 8 | libsoup | Fixed | RHSA-2026:84586 | 19.10.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | libsoup | Fixed | RHSA-2026:92347 | 29.10.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | libsoup | Fixed | RHSA-2026:92347 | 29.10.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | libsoup | Fixed | RHSA-2026:93716 | 02.11.2026 |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | libsoup | Fixed | RHSA-2026:93716 | 02.11.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.6 High
CVSS3
Связанные уязвимости
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.
Libsoup: libsoup: heap buffer overflow during websocket message reassembly
A flaw was found in libsoup. When reassembling fragmented WebSocket me ...
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.
EPSS
8.6 High
CVSS3