Описание
Security update for libsoup
This update for libsoup fixes the following issues:
- CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame (bsc#1271401).
- CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch (bsc#1272195).
- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol violation (bsc#1271446).
- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak (bsc#1271448).
- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string (bsc#1271449).
- CVE-2026-66339: proxy credentials leak to destination server via
Proxy-Authorizationheader in CONNECT tunnels (bsc#1273156). - CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling (bsc#1283831).
Список пакетов
SUSE Linux Enterprise Server 12 SP5-LTSS
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
Ссылки
- Link for SUSE-SU-2026:4690-1
- E-Mail link for SUSE-SU-2026:4690-1
- SUSE Security Ratings
- SUSE Bug 1271401
- SUSE Bug 1271446
- SUSE Bug 1271448
- SUSE Bug 1271449
- SUSE Bug 1272195
- SUSE Bug 1273156
- SUSE Bug 1283300
- SUSE Bug 1283301
- SUSE Bug 1283302
- SUSE Bug 1283303
- SUSE Bug 1283831
- SUSE CVE CVE-2026-0716 page
- SUSE CVE CVE-2026-102556 page
- SUSE CVE CVE-2026-102557 page
- SUSE CVE CVE-2026-102558 page
- SUSE CVE CVE-2026-102559 page
- SUSE CVE CVE-2026-103399 page
Описание
A flaw was found in libsoup's WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or a crash. Applications using libsoup's WebSocket support with this configuration may be impacted.
Затронутые продукты
Ссылки
- CVE-2026-0716
- SUSE Bug 1256418
- SUSE Bug 1271401
Описание
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.
Затронутые продукты
Ссылки
- CVE-2026-102556
- SUSE Bug 1283300
Описание
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.
Затронутые продукты
Ссылки
- CVE-2026-102557
- SUSE Bug 1283301
Описание
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.
Затронутые продукты
Ссылки
- CVE-2026-102558
- SUSE Bug 1283302
Описание
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
Затронутые продукты
Ссылки
- CVE-2026-102559
- SUSE Bug 1283303
Описание
A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.
Затронутые продукты
Ссылки
- CVE-2026-103399
- SUSE Bug 1283831
Описание
The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.
Затронутые продукты
Ссылки
- CVE-2026-12478
- SUSE Bug 1271401
Описание
SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.
Затронутые продукты
Ссылки
- CVE-2026-12547
- SUSE Bug 1272195
Описание
A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.
Затронутые продукты
Ссылки
- CVE-2026-12548
- SUSE Bug 1272196
Описание
A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirected to a different host. As a result, sensitive proxy credentials may be leaked to third-party servers. Applications using libsoup for HTTP communication may unintentionally expose proxy authentication data.
Затронутые продукты
Ссылки
- CVE-2026-1539
- SUSE Bug 1257441
Описание
A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 <paragraph>5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets.
Затронутые продукты
Ссылки
- CVE-2026-15711
- SUSE Bug 1271446
Описание
A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash.
Затронутые продукты
Ссылки
- CVE-2026-15713
- SUSE Bug 1271448
Описание
An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which does not adequately restrict or validate the size of incoming multipart boundary strings. When processing a crafted HTTP response containing a malformed or oversized boundary parameter, the internal stream reader reads past the allocated buffer bounds. A remote, unauthenticated attacker can exploit this behavior to cause a service denial (DoS) through application failure or potentially read fragments of unauthorized memory metadata.
Затронутые продукты
Ссылки
- CVE-2026-15714
- SUSE Bug 1271449
Описание
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
Затронутые продукты
Ссылки
- CVE-2026-66339
- SUSE Bug 1273156