Описание
Security update for libsoup
This update for libsoup fixes the following issues:
- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak (bsc#1271448).
- CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding (bsc#1283299).
- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).
Список пакетов
SUSE Linux Enterprise Module for Basesystem 15 SP7
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP6
Ссылки
- Link for SUSE-SU-2026:4631-1
- E-Mail link for SUSE-SU-2026:4631-1
- SUSE Security Ratings
- SUSE Bug 1271448
- SUSE Bug 1283299
- SUSE Bug 1283300
- SUSE Bug 1283301
- SUSE Bug 1283302
- SUSE Bug 1283303
- SUSE Bug 1283304
- SUSE CVE CVE-2026-102555 page
- SUSE CVE CVE-2026-102556 page
- SUSE CVE CVE-2026-102557 page
- SUSE CVE CVE-2026-102558 page
- SUSE CVE CVE-2026-102559 page
- SUSE CVE CVE-2026-102560 page
- SUSE CVE CVE-2026-12548 page
- SUSE CVE CVE-2026-15713 page
- SUSE CVE CVE-2026-2708 page
Описание
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.
Затронутые продукты
Ссылки
- CVE-2026-102555
- SUSE Bug 1283299
Описание
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.
Затронутые продукты
Ссылки
- CVE-2026-102556
- SUSE Bug 1283300
Описание
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.
Затронутые продукты
Ссылки
- CVE-2026-102557
- SUSE Bug 1283301
Описание
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.
Затронутые продукты
Ссылки
- CVE-2026-102558
- SUSE Bug 1283302
Описание
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
Затронутые продукты
Ссылки
- CVE-2026-102559
- SUSE Bug 1283303
Описание
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
Затронутые продукты
Ссылки
- CVE-2026-102560
- SUSE Bug 1283304
Описание
A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.
Затронутые продукты
Ссылки
- CVE-2026-12548
- SUSE Bug 1272196
Описание
A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash.
Затронутые продукты
Ссылки
- CVE-2026-15713
- SUSE Bug 1271448
Описание
A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.
Затронутые продукты
Ссылки
- CVE-2026-2708
- SUSE Bug 1258508