Описание
Security update for libsoup
This update for libsoup fixes the following issues:
- CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch (bsc#1272195).
- CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation (bsc#1272196).
- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol violation (bsc#1271446).
- CVE-2026-15712: SoupClientMessageIOHTTP2: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid NUL- termination assumption (bsc#1271447).
- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak (bsc#1271448).
- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string (bsc#1271449).
- CVE-2026-66339: proxy credentials leak to destination server via
Proxy-Authorizationheader in CONNECT tunnels (bsc#1273156). - CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding (bsc#1283299).
- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).
- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling (bsc#1283831).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1271446
- SUSE Bug 1271447
- SUSE Bug 1271448
- SUSE Bug 1271449
- SUSE Bug 1272195
- SUSE Bug 1272196
- SUSE Bug 1273156
- SUSE Bug 1283299
- SUSE Bug 1283300
- SUSE Bug 1283301
- SUSE Bug 1283302
- SUSE Bug 1283303
- SUSE Bug 1283304
- SUSE Bug 1283831
- SUSE CVE CVE-2026-102555 page
- SUSE CVE CVE-2026-102556 page
- SUSE CVE CVE-2026-102557 page
- SUSE CVE CVE-2026-102558 page
- SUSE CVE CVE-2026-102559 page
Описание
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.
Затронутые продукты
Ссылки
- CVE-2026-102555
- SUSE Bug 1283299
Описание
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.
Затронутые продукты
Ссылки
- CVE-2026-102556
- SUSE Bug 1283300
Описание
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.
Затронутые продукты
Ссылки
- CVE-2026-102557
- SUSE Bug 1283301
Описание
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.
Затронутые продукты
Ссылки
- CVE-2026-102558
- SUSE Bug 1283302
Описание
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
Затронутые продукты
Ссылки
- CVE-2026-102559
- SUSE Bug 1283303
Описание
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
Затронутые продукты
Ссылки
- CVE-2026-102560
- SUSE Bug 1283304
Описание
A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling.
Затронутые продукты
Ссылки
- CVE-2026-103399
- SUSE Bug 1283831
Описание
SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.
Затронутые продукты
Ссылки
- CVE-2026-12547
- SUSE Bug 1272195
Описание
A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.
Затронутые продукты
Ссылки
- CVE-2026-12548
- SUSE Bug 1272196
Описание
A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 <paragraph>5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets.
Затронутые продукты
Ссылки
- CVE-2026-15711
- SUSE Bug 1271446
Описание
A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents.
Затронутые продукты
Ссылки
- CVE-2026-15712
- SUSE Bug 1271447
Описание
A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash.
Затронутые продукты
Ссылки
- CVE-2026-15713
- SUSE Bug 1271448
Описание
An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which does not adequately restrict or validate the size of incoming multipart boundary strings. When processing a crafted HTTP response containing a malformed or oversized boundary parameter, the internal stream reader reads past the allocated buffer bounds. A remote, unauthenticated attacker can exploit this behavior to cause a service denial (DoS) through application failure or potentially read fragments of unauthorized memory metadata.
Затронутые продукты
Ссылки
- CVE-2026-15714
- SUSE Bug 1271449
Описание
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
Затронутые продукты
Ссылки
- CVE-2026-66339
- SUSE Bug 1273156