OESA-2026-4667: libsoup security update
libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fix(es):
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.(CVE-2026-102556)
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.(CVE-2026-102557)
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.(CVE-2026-102559)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/libsoupto a version that resolves this vulnerability.Fixed in 2.74.3-31.oe2403sp3
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which applications are exposed to the Pong-frame issue?
Applications using SoupWebsocketConnection that connect a ::pong signal handler expecting the documented GBytes API are exposed. A remote peer can trigger heap corruption or a crash by sending a crafted WebSocket Pong frame.
What does an attacker need to do to trigger the fragmented-message issue?
A remote peer needs to send fragmented WebSocket messages whose total size causes size truncation during reassembly. The resulting mismatch between the truncated buffer size and full length can lead to heap corruption or a crash.