Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:21871-1

Опубликовано: 17 сент. 2026
Источник: suse-cvrf

Описание

Security update for libsoup

This update for libsoup fixes the following issues

  • CVE-2026-0716: out-of-bounds read when processing a crafted unmasked frame with a payload length near UINT64_MAX sent by a WebSocket server (bsc#1256418).

Список пакетов

openSUSE Leap 16.0
libsoup-3_0-0-3.6.6-160000.3.1
libsoup-devel-3.6.6-160000.3.1
libsoup-lang-3.6.6-160000.3.1
typelib-1_0-Soup-3_0-3.6.6-160000.3.1

Ссылки

Описание

The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.

Затронутые продукты
openSUSE Leap 16.0:libsoup-3_0-0-3.6.6-160000.3.1
openSUSE Leap 16.0:libsoup-devel-3.6.6-160000.3.1
openSUSE Leap 16.0:libsoup-lang-3.6.6-160000.3.1
openSUSE Leap 16.0:typelib-1_0-Soup-3_0-3.6.6-160000.3.1
Ссылки