Описание
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.
Отчет
This issue is rated Important. A remote WebSocket peer can cause heap corruption or denial of service, especially when applications leave incoming payload size unlimited. Default configurations that set a finite max-incoming-payload-size reduce exposure but the vulnerable code path remains relevant for applications that disable the limit.
Меры по смягчению последствий
To mitigate this configure a finite max-incoming-payload-size (do not set it to 0/unlimited) on SoupWebsocketConnection. Restrict WebSocket exposure to trusted peers.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | libsoup | Out of support scope | ||
| Red Hat Enterprise Linux 10 | libsoup3 | Fixed | RHSA-2026:83618 | 15.10.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | libsoup3 | Fixed | RHSA-2026:93583 | 02.11.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | libsoup | Fixed | RHSA-2026:93465 | 02.11.2026 |
| Red Hat Enterprise Linux 8 | libsoup | Fixed | RHSA-2026:84586 | 19.10.2026 |
| Red Hat Enterprise Linux 8 | libsoup | Fixed | RHSA-2026:84586 | 19.10.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | libsoup | Fixed | RHSA-2026:92347 | 29.10.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | libsoup | Fixed | RHSA-2026:92347 | 29.10.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | libsoup | Fixed | RHSA-2026:93716 | 02.11.2026 |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | libsoup | Fixed | RHSA-2026:93716 | 02.11.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.6 High
CVSS3
Связанные уязвимости
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.
Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth
A flaw was found in libsoup. When max-incoming-payload-size is unlimit ...
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.
EPSS
8.6 High
CVSS3