UBUNTU-CVE-2026-102557: High severity ubuntu/libsoup2.4 vulnerability
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.
Affected Software
Event History
Frequently Asked Questions
Does exploiting this issue require authentication or user interaction?
No. The reported vector is network-accessible with low attack complexity, no privileges required, and no user interaction required. An attacker would need to act as a remote peer sending fragmented WebSocket messages.
Which Ubuntu packages are identified as affected?
The affected software listed is ubuntu/libsoup2.4 and ubuntu/libsoup3.
What is the potential security impact?
The issue can cause heap corruption or a crash. The severity vector indicates potential low confidentiality and integrity impact and high availability impact.