UBUNTU-CVE-2026-102559: Buffer Overflow
Published Sep 29, 2026
·Updated
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
Affected Software
11 affected components
ubuntu/libsoup2.4*
ubuntu/libsoup2.4*
ubuntu/libsoup2.4*
ubuntu/libsoup2.4*
ubuntu/libsoup3*
ubuntu/libsoup2.4*
ubuntu/libsoup3*
ubuntu/libsoup2.4*
ubuntu/libsoup3*
ubuntu/libsoup3*
ubuntu/libsoup2.4*
Event History
Sep 29, 2026
CVE Published
via OSV·06:17 PM
Data Sourced
via OSV·06:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which systems are exposed to this issue?
Ubuntu systems using libsoup2.4 or libsoup3 are potentially affected when an application constructs masked WebSocket client frames with very large outgoing payloads.
2
What condition triggers the overflow?
The issue occurs when a very large outgoing WebSocket payload causes size values passed to GByteArray allocation APIs to be truncated, while the masking routine continues to use the original full payload length. This mismatch can result in a heap buffer overflow.