OESA-2026-4669: libsoup security update
libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fix(es):
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.(CVE-2026-102556)
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.(CVE-2026-102557)
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.(CVE-2026-102559)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/libsoupto a version that resolves this vulnerability.Fixed in 2.74.3-31.oe2403sp1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which applications are exposed to the incoming WebSocket issues?
Applications using libsoup WebSocket connections may be exposed when they receive WebSocket traffic from a remote peer. The Pong-frame issue specifically affects applications that connect a ::pong signal handler following the documented GBytes API.
What must an attacker do to trigger the incoming-message vulnerabilities?
An attacker needs to act as a remote WebSocket peer and send crafted WebSocket data. The described inputs include a crafted Pong frame and fragmented messages whose total size causes size truncation during reassembly.
Can the issue be triggered without authentication or user interaction?
The supplied severity vector indicates network access, low attack complexity, no privileges required, and no user interaction required. Exploitation depends on an application accepting WebSocket traffic from the attacker.
What are the likely effects of successful exploitation?
The described flaws can cause heap corruption or a crash. The severity vector also indicates potential impacts to confidentiality, integrity, and availability.