OESA-2026-4668: libsoup security update
libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fix(es):
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.(CVE-2026-102556)
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.(CVE-2026-102557)
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.(CVE-2026-102559)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/libsoupto a version that resolves this vulnerability.Fixed in 2.74.2-28.oe2203sp4
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which deployments are exposed to the incoming Pong-frame issue?
Applications using SoupWebsocketConnection that connect a Pong signal handler following the documented GBytes API are exposed when they receive a crafted WebSocket Pong frame. The resulting type mismatch can cause heap corruption or a crash.
What does an attacker need to exploit the fragmented-message issue?
An attacker needs to act as a remote WebSocket peer and send fragmented messages that trigger size truncation during reassembly. No privileges or user interaction are indicated by the provided severity vector.
What is the expected operational impact?
The listed issues can cause heap corruption or application crashes. The severity vector also indicates potential low confidentiality and integrity impact, with high availability impact.