Описание
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
Отчет
This issue is rated Important. Triggering requires causing a libsoup WebSocket client (or client-role connection) to send an extremely large message. That may be reachable when application-level message size is attacker-influenced. Impact is heap corruption or denial of service in the sending process.
Меры по смягчению последствий
To mitigate this enforce application-level limits on outgoing WebSocket message sizes. Do not send untrusted bulk data as a single WebSocket message.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | libsoup | Out of support scope | ||
| Red Hat Enterprise Linux 10 | libsoup3 | Fixed | RHSA-2026:83618 | 15.10.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | libsoup3 | Fixed | RHSA-2026:93583 | 02.11.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | libsoup | Fixed | RHSA-2026:93465 | 02.11.2026 |
| Red Hat Enterprise Linux 8 | libsoup | Fixed | RHSA-2026:84586 | 19.10.2026 |
| Red Hat Enterprise Linux 8 | libsoup | Fixed | RHSA-2026:84586 | 19.10.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | libsoup | Fixed | RHSA-2026:92347 | 29.10.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | libsoup | Fixed | RHSA-2026:92347 | 29.10.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | libsoup | Fixed | RHSA-2026:93716 | 02.11.2026 |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | libsoup | Fixed | RHSA-2026:93716 | 02.11.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.6 High
CVSS3
Связанные уязвимости
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
Libsoup: libsoup: heap buffer overflow during websocket client-frame masking
A flaw was found in libsoup. When constructing a masked WebSocket clie ...
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
EPSS
8.6 High
CVSS3