CVE-2026-102557
Fixed in a distro release EPSS <1%CVSS 8.6
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | libsoup3 | 3.6.5-3.el10_2.20 |
| AlmaLinux 10 | libsoup3-devel | 3.6.5-3.el10_2.20 |
| AlmaLinux 10 | libsoup3-doc | 3.6.5-3.el10_2.20 |
| AlmaLinux 8 | libsoup | 2.62.3-19.el8_10 |
| AlmaLinux 8 | libsoup-devel | 2.62.3-19.el8_10 |
| AlmaLinux 9 | libsoup | 2.72.0-16.el9_8.8 |
| AlmaLinux 9 | libsoup-devel | 2.72.0-16.el9_8.8 |
| Debian 12 | libsoup2.4 | no fix |
| Debian 12 | libsoup3 | no fix |
| Debian 13 | libsoup2.4 | no fix |
| Debian 13 | libsoup3 | no fix |
| Debian 14 | libsoup3 | 3.8.0-1 |
| Red Hat Enterprise Linux 10.2 | libsoup3 | 0:3.6.5-3.el10_2.20 |
| Red Hat Enterprise Linux 10.2 | libsoup3-debuginfo | 0:3.6.5-3.el10_2.20 |
| Red Hat Enterprise Linux 10.2 | libsoup3-debugsource | 0:3.6.5-3.el10_2.20 |
| Red Hat Enterprise Linux 10.2 | libsoup3-devel | 0:3.6.5-3.el10_2.20 |
| Red Hat Enterprise Linux 10.2 | libsoup3-doc | 0:3.6.5-3.el10_2.20 |
| Red Hat Enterprise Linux 8 | libsoup | 0:2.62.3-19.el8_10 |
| Red Hat Enterprise Linux 8 | libsoup-debuginfo | 0:2.62.3-19.el8_10 |
| Red Hat Enterprise Linux 8 | libsoup-debugsource | 0:2.62.3-19.el8_10 |
| Red Hat Enterprise Linux 8 | libsoup-devel | 0:2.62.3-19.el8_10 |
| Red Hat Enterprise Linux 9 | libsoup | 0:2.72.0-16.el9_8.8 |
| Red Hat Enterprise Linux 9 | libsoup-debuginfo | 0:2.72.0-16.el9_8.8 |
| Red Hat Enterprise Linux 9 | libsoup-debugsource | 0:2.72.0-16.el9_8.8 |
| Red Hat Enterprise Linux 9 | libsoup-devel | 0:2.72.0-16.el9_8.8 |
| Rocky Linux 8 | libsoup | 0:2.62.3-19.el8_10 |
| Rocky Linux 9 | libsoup | 0:2.72.0-16.el9_8.8 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | libsoup | 3.0.4-150400.3.55.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | libsoup | 3.0.4-150400.3.55.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | libsoup | 3.0.4-150400.3.55.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | libsoup | 3.0.4-150400.3.55.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise Micro 5.3 | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise Micro 5.4 | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise Micro 5.5 | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | libsoup | 3.4.4-150600.3.59.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | libsoup2 | 2.74.3-150600.4.42.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | libsoup | 2.62.2-5.49.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | libsoup | 3.0.4-150400.3.55.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | libsoup | 3.0.4-150400.3.55.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | libsoup | 3.4.4-150600.3.59.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | libsoup2 | 2.74.3-150600.4.42.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | libsoup | 2.62.2-5.49.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | libsoup | 3.0.4-150400.3.55.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | libsoup | 3.0.4-150400.3.55.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | libsoup2 | 2.74.3-150400.3.43.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | libsoup | 3.4.4-150600.3.59.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | libsoup2 | 2.74.3-150600.4.42.1 |
| Ubuntu 22.04 LTS | libsoup2.4 | no fix |
| Ubuntu 24.04 LTS | libsoup2.4 | no fix |
| Ubuntu 24.04 LTS | libsoup3 | no fix |
| Ubuntu 26.04 LTS | libsoup3 | no fix |
| Ubuntu 26.10 | libsoup2.4 | no fix |
| Ubuntu 26.10 | libsoup3 | no fix |
| Ubuntu Pro 16.04 LTS | libsoup2.4 | no fix |
| Ubuntu Pro 18.04 LTS | libsoup2.4 | no fix |
| Ubuntu Pro 20.04 LTS | libsoup2.4 | no fix |
| Ubuntu Pro 22.04 LTS | libsoup3 | no fix |
| Ubuntu Pro 26.04 LTS | libsoup2.4 | no fix |
| openSUSE Tumbleweed | libsoup2 | 2.74.3-24.1 |