OESA-2026-4781: libsoup security update
libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fix(es):
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.(CVE-2026-102556)
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.(CVE-2026-102557)
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.(CVE-2026-102559)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/libsoupto a version that resolves this vulnerability.Fixed in 2.74.3-31.oe2403sp4
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which applications are exposed to the Pong-frame issue?
Applications using libsoup WebSocket connections are exposed if they connect a ::pong signal handler that follows the documented GBytes API. A remote peer can trigger heap corruption or a crash by sending a crafted WebSocket Pong frame.
Does exploitation require an authenticated attacker or user interaction?
The reported issues are rated AV:N/AC:L/PR:N/UI:N. The descriptions identify a remote peer sending crafted Pong frames or fragmented WebSocket messages as the attack source.
Are only incoming WebSocket messages relevant?
No. In addition to flaws processing incoming Pong frames and fragmented messages, the update describes a flaw when a client constructs a masked WebSocket frame for a very large outgoing payload, where truncated allocation sizes can lead to unsafe use of the full length.