CVE-2026-102556: Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.
Other sources
A type-confusion heap overflow was found in libsoup's WebSocket Pong handling.
SoupWebsocketConnection::pong is declared to deliver a GBytes payload, but receivepong() emitted a GByteArray pointer via gsignalemit() and then unreffed the GByteArray. Handlers that treated the argument as GBytes (as documented) operated on the wrong object layout, resulting in heap memory corruption / overflow conditions under ASan.
Fixed upstream by converting the buffer with gbytearrayfreetobytes() before emission (commit d2cbaf25, libsoup 3.7.3).
References: https://gitlab.gnome.org/GNOME/libsoup/-/workitems/554 (Bug 2) https://gitlab.gnome.org/GNOME/libsoup/-/commit/d2cbaf25
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libsoupto a version that resolves this vulnerability.Fixed in 3.7.3Patch d2cbaf25
Event History
Frequently Asked Questions
Which applications are exposed to this flaw?
Applications using libsoup WebSocket connections are exposed if they register a SoupWebsocketConnection::pong handler that treats its payload according to the documented GBytes API.
What must an attacker do to trigger the issue?
An attacker needs to cause the application to receive a crafted WebSocket Pong frame. No authentication or user interaction is indicated by the supplied severity vector.
Are applications that do not handle the pong signal affected?
The described heap corruption occurs when an application connects a pong-signal handler and operates on the received argument as a GBytes object. The provided information does not describe an impact for applications without such a handler.
What version contains the upstream fix?
The issue is fixed in libsoup 3.7.3. Upstream fixed it by converting the GByteArray to GBytes before emitting the pong signal.