CVE-2026-102559: Libsoup: libsoup: heap buffer overflow during websocket client-frame masking
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
Other sources
A heap buffer overflow was found in libsoup's client-side WebSocket frame construction / masking path.
Outgoing frames are built in a GByteArray. For a send payload larger than the array can represent (at/above ~2^31), gbytearraysizednew() / append truncated the length while xorwithmask() still iterated the full attacker-/caller-controlled length, writing past the small allocation during masking.
Fixed by rejecting outgoing payloads above MAXOUTGOINGPAYLOADSIZE both before and after extensions process the payload (commit d7f074f8, libsoup 3.7.3).
References: https://gitlab.gnome.org/GNOME/libsoup/-/workitems/554 (Bug 7) https://gitlab.gnome.org/GNOME/libsoup/-/commit/d7f074f8
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libsoupto a version that resolves this vulnerability.Fixed in 3.7.3Patch d7f074f8
Event History
Frequently Asked Questions
Which applications are exposed to this flaw?
Applications using libsoup’s client-side WebSocket functionality are exposed when they construct masked outgoing WebSocket frames. The vulnerable path is triggered by a very large outgoing payload.
What is required to trigger the overflow?
The caller-controlled outgoing payload must be at or above approximately 2^31 bytes, large enough for GByteArray size handling to truncate the allocation length. The masking routine then processes the full payload length and writes beyond the undersized heap allocation.
Does processing by WebSocket extensions matter?
Yes. The fix enforces the outgoing payload limit both before and after extensions process the payload, indicating that extension processing can affect the payload size that reaches frame construction.
What version includes the documented fix?
The issue is fixed in libsoup 3.7.3 by rejecting outgoing payloads larger than MAX_OUTGOING_PAYLOAD_SIZE before and after extension processing.