UBUNTU-CVE-2026-102558: Buffer Overflow
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected by this issue?
Ubuntu deployments using libsoup2.4 or libsoup3 are affected when SoupWebsocketConnection is configured with max-incoming-payload-size set to 0, meaning unlimited incoming payload size.
What access does an attacker need?
The severity vector indicates network-based exploitation with low attack complexity, no privileges, and no user interaction required. An attacker needs to be able to send crafted WebSocket frame data to the vulnerable connection.
What is the likely impact of successful exploitation?
An attacker-controlled frame length can cause an integer length wrap and heap buffer overflow while frame data is read. The recorded impact includes low confidentiality and integrity impact and high availability impact.