CVE-2026-102557: Libsoup: libsoup: heap buffer overflow during websocket message reassembly
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote peer that can send WebSocket traffic to an application using the affected libsoup functionality can trigger the flaw. No privileges or user interaction are required according to the supplied severity vector.
What does an attacker need to send?
The attacker needs to send fragmented WebSocket messages whose cumulative size causes truncation during reassembly into a GByteArray. The implementation may then use the full length despite the truncated size, causing heap corruption or a crash.
What is the likely impact?
Successful exploitation can cause a denial of service through a crash and may result in heap corruption. The supplied severity vector also indicates potential low-impact confidentiality and integrity effects.