CVE-2026-0716: Libsoup: out-of-bounds read in libsoup websocket frame processing
A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or a crash. Applications using libsoup’s WebSocket support with this configuration may be impacted.
Other sources
An out-of-bounds read vulnerability exists in the processframe() function of libsoup’s SoupWebSocketConnection. When maxincomingpayloadsize is explicitly set to 0, improper bounds handling allows the function to read beyond the allocated buffer while processing WebSocket frames. This condition can lead to memory disclosure or application instability. Exploitation requires a non-default configuration and a remote attacker capable of sending crafted WebSocket frames.
— Red Hat
Libsoup: out-of-bounds read in libsoup websocket frame processing
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0716?
CVE-2026-0716 is classified as a moderate severity vulnerability due to the potential for out-of-bounds memory reads.
How does CVE-2026-0716 affect libsoup?
CVE-2026-0716 affects libsoup by allowing it to read memory outside of the intended bounds when processing WebSocket frames with an improperly configured maximum payload size.
How can I mitigate CVE-2026-0716?
To mitigate CVE-2026-0716, ensure that the maximum incoming payload size is set to a defined limit in your libsoup configuration.
Is there a fix available for CVE-2026-0716?
Yes, a fix for CVE-2026-0716 is available in the latest versions of libsoup.
What configurations are vulnerable in CVE-2026-0716?
CVE-2026-0716 is vulnerable when libsoup is configured with an unset maximum incoming payload size.