CVE-2026-102560: Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
Other sources
A heap buffer overflow was found in libsoup's WebSocket permessage-deflate outgoing path.
soupwebsocketextensiondeflateprocessoutgoingmessage() stored deflateBound()'s uLong result in a guint and grew a GByteArray by that amount. For payloads approaching 4 GiB, the bound exceeds GMAXUINT; truncation allowed buffer->len + maxlength to wrap on later growth, and zlib wrote through nextout past the allocation.
Fixed by refusing payloads whose compressed bound cannot fit in a GByteArray and by checking each incremental growth (commit dbd0417e, libsoup 3.7.3).
References: https://gitlab.gnome.org/GNOME/libsoup/-/workitems/554 (Bug 8) https://gitlab.gnome.org/GNOME/libsoup/-/commit/dbd0417e
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libsoupto a version that resolves this vulnerability.Fixed in 3.7.3Patch dbd0417e
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using libsoup WebSocket connections with the permessage-deflate extension enabled are affected when they compress very large outgoing messages. The vulnerable code path is the extension's outgoing-message processing path.
What message size is required to trigger the overflow?
The issue occurs for payloads approaching 4 GiB, where the compressed-size bound can exceed the maximum value representable by a GByteArray growth calculation. Smaller messages are not described as triggering this condition.
What should be done if an update cannot be applied immediately?
Avoid sending extremely large outgoing WebSocket messages through permessage-deflate. Disabling the permessage-deflate extension prevents use of the affected outgoing compression path.
How can I determine whether the installed library includes the fix?
The fix is included in libsoup 3.7.3 and is associated with commit dbd0417e. The corrected code rejects payloads whose compressed bound cannot fit in a GByteArray and checks incremental buffer growth.