Описание
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
Отчет
This issue is rated Important. Exploitation requires the permessage-deflate extension to be negotiated and a very large outgoing message to be compressed. Applications that enable WebSocket deflate with untrusted or unbounded message sizes are affected. Impact is heap corruption or denial of service.
Меры по смягчению последствий
To mitigate this disable the permessage-deflate WebSocket extension if it is not required, and cap outgoing message sizes.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | libsoup | Out of support scope | ||
| Red Hat Enterprise Linux 7 | libsoup | Not affected | ||
| Red Hat Enterprise Linux 8 | libsoup | Not affected | ||
| Red Hat Enterprise Linux 10 | libsoup3 | Fixed | RHSA-2026:83618 | 15.10.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | libsoup3 | Fixed | RHSA-2026:93583 | 02.11.2026 |
| Red Hat Enterprise Linux 9 | libsoup | Fixed | RHSA-2026:83384 | 15.10.2026 |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | libsoup | Fixed | RHSA-2026:93447 | 02.11.2026 |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | libsoup | Fixed | RHSA-2026:93445 | 02.11.2026 |
| Red Hat Enterprise Linux 9.6 Extended Update Support | libsoup | Fixed | RHSA-2026:93446 | 02.11.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.6 High
CVSS3
Связанные уязвимости
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth
A flaw was found in libsoup. When the permessage-deflate WebSocket ext ...
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
EPSS
8.6 High
CVSS3