CVE-2026-102557: Libsoup: libsoup: heap buffer overflow during websocket message reassembly
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.
Other sources
A heap buffer overflow was found in libsoup WebSocket fragmented-message reassembly.
Reassembled messages are stored in a GByteArray (length typed as guint). A sequence of fragments (or extension expansion) that grew the message past GMAXINT caused gbytearraysetsize() / related growth APIs to truncate the size while surrounding code continued to use the full length, corrupting the heap. Upstream notes interaction with older GLib (e.g. 2.70) growth behavior.
Fixed by rejecting reassembly that would exceed what a GByteArray can safely hold, independently of max-total-message-size (commit d7f074f8, libsoup 3.7.3).
References: https://gitlab.gnome.org/GNOME/libsoup/-/workitems/554 (Bug 5) https://gitlab.gnome.org/GNOME/libsoup/-/commit/d7f074f8
— Red Hat
Libsoup: libsoup: heap buffer overflow during websocket message reassembly
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.4.4-17 - Upgrade
Upgrade
libsoupto a version that resolves this vulnerability.Fixed in 3.7.3Patch d7f074f8
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote peer that can send WebSocket traffic to an application using the affected libsoup functionality can trigger the flaw. No privileges or user interaction are required according to the supplied severity vector.
What does an attacker need to send?
The attacker needs to send fragmented WebSocket messages whose cumulative size causes truncation during reassembly into a GByteArray. The implementation may then use the full length despite the truncated size, causing heap corruption or a crash.
What is the likely impact?
Successful exploitation can cause a denial of service through a crash and may result in heap corruption. The supplied severity vector also indicates potential low-impact confidentiality and integrity effects.