High priorityDisclosed

Advisory · CVE-2026-102558

libsoup WebSocket frame reader heap overflow is remotely triggerable

When max-incoming-payload-size is unlimited, libsoup's SoupWebsocketConnection grows its incoming buffer from an attacker-controlled frame length until it wraps, causing a heap buffer overflow while reading frame data.

Advisory published September 29, 2026Independent summary
Vendor
Red Hat
Product
libsoup
Identifier / CWE
CVE-2026-102558
CWE-125
Action timing
Immediate
ELI5

Explain it like I’m five

libsoup listens on a WebSocket and asks the caller how much data is coming, then sets aside exactly that much room. A hostile caller lies about the size, the room calculation wraps around to almost nothing, and the incoming data overflows into memory the attacker did not ask for.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01WebSocket connection

    An unauthenticated attacker connects to a service using libsoup WebSockets with no payload size limit.

  2. 02Crafted frame length

    The attacker sends a frame header declaring an attacker-controlled length.

  3. 03Length wrap

    The incoming buffer grows from the declared length until the value wraps, producing an undersized allocation.

  4. 04Heap overflow

    Frame data is read past the allocation, causing a heap buffer overflow.

What happened

Red Hat disclosed CVE-2026-102558 in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection grows its incoming byte array based on an attacker-controlled frame length until the length wraps, causing a heap buffer overflow while reading frame data. It affects RHEL 6 through 10 libsoup/libsoup3 packages and carries a CVSS 3.1 score of 8.6 (high).

What to do

  1. Apply updated libsoup packages from your vendor as they are released.
  2. Where possible, set a non-zero max-incoming-payload-size on WebSocket connections so the vulnerable path is not reachable.
  3. Prioritize internet-facing services that keep libsoup WebSocket servers open to unauthenticated clients.
  4. Review logs and crash telemetry for anomalous WebSocket frames with extreme declared lengths.

Management note

libsoup underpins HTTP and WebSocket handling in a large GNOME and Linux application surface, so this is a library-level flaw with broad blast radius. Patching the library once beats hunting every downstream application, but both inventories matter.