CVE-2026-102556: libsoup Buffer Overflow Vulnerability

CVE-2026-102556 Overview

A type confusion flaw exists in libsoup, the HTTP client/server library used by GNOME and many Linux applications. The SoupWebsocketConnection object emits the ::pong signal with a GByteArray pointer, but the signal is declared to pass a GBytes object. Applications that connect a handler following the documented GBytes API misinterpret the underlying memory layout. A remote attacker who can send a crafted WebSocket Pong frame can trigger heap corruption or a process crash in the receiving application.

Critical Impact
Remote attackers can corrupt heap memory or crash any application using libsoup WebSocket clients or servers by sending a malformed Pong frame, with no authentication or user interaction required.

Affected Products

libsoup (GNOME HTTP client/server library)
Applications linking libsoup and consuming the SoupWebsocketConnection::pong signal
Red Hat Enterprise Linux distributions shipping affected libsoup packages

Discovery Timeline

2026-09-29 - CVE CVE-2026-102556 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-102556

Vulnerability Analysis

The vulnerability is a type confusion defect [CWE-843] in libsoup's WebSocket implementation. When the library receives a WebSocket Pong control frame, SoupWebsocketConnection emits its ::pong signal to notify application handlers. The signal is publicly declared to deliver payload data as a GBytes object, which is the immutable, reference-counted byte buffer type in GLib. Internally, however, the emitter passes a GByteArray pointer, a distinct mutable structure with a different memory layout.

Applications following the documented API interact with the pointer as if it were a GBytes instance. Calls such as g_bytes_get_data() or g_bytes_get_size() dereference fields at offsets that do not correspond to the actual GByteArray layout. Attacker-controlled Pong payloads can influence adjacent memory or produce invalid length values, leading to heap corruption or an immediate crash.

Root Cause

The root cause is a mismatch between the signal signature and the argument type actually emitted. The signal definition promises GBytes semantics while the implementation supplies a GByteArray. GLib's signal system performs no runtime type coercion for boxed pointer types, so the mistyped pointer flows directly to consumer callbacks.

Attack Vector

The attack vector is remote and unauthenticated. Any peer capable of establishing a WebSocket session with a vulnerable libsoup client or server can send a crafted Pong frame. When the application processes the frame through a ::pong handler that treats the argument as GBytes, memory corruption or a crash occurs in the application process. Because WebSocket Pong frames are unsolicited control frames permitted at any time in a session, the trigger requires no specific application state.

No verified public proof-of-concept code is available. Refer to the Red Hat CVE-2026-102556 Advisory and Red Hat Bug Report #2543229 for upstream technical details.

Detection Methods for CVE-2026-102556

Indicators of Compromise

Unexpected crashes or SIGSEGV core dumps in processes linked against libsoup shortly after establishing outbound or inbound WebSocket sessions.
Heap corruption warnings from glibc such as malloc_consolidate(): invalid chunk size or double free or corruption in application logs.
Anomalous inbound WebSocket Pong frames arriving without prior Ping frames, or Pong frames with unusually large or malformed payloads.

Detection Strategies

Inventory installed libsoup versions across Linux hosts and correlate with vendor advisories to identify unpatched systems.
Deploy network monitoring rules that flag WebSocket Pong frames exceeding expected payload sizes or arriving outside a Ping/Pong exchange.
Enable AddressSanitizer or glibc MALLOC_CHECK_ in test environments to surface memory corruption in libsoup-consuming applications during fuzzing.

Monitoring Recommendations

Forward application crash telemetry and systemd coredumpctl events into centralized logging to detect exploitation attempts at scale.
Monitor egress and ingress WebSocket traffic on hosts running GNOME-based agents, browsers, or IoT applications that link libsoup.
Track package inventory changes to confirm patched libsoup versions are deployed after vendor releases.

How to Mitigate CVE-2026-102556

Immediate Actions Required

Apply the libsoup security update from your Linux distribution as soon as it becomes available.
Identify all applications on affected hosts that consume the SoupWebsocketConnection::pong signal and audit their handlers.
Restrict outbound WebSocket connections from sensitive workloads to trusted endpoints until patches are deployed.

Patch Information

Refer to the Red Hat CVE-2026-102556 Advisory for distribution-specific package versions and errata. Upstream tracking is available in Red Hat Bug Report #2543229. Rebuild and redeploy any statically linked applications after the fixed libsoup is installed.

Workarounds

Disconnect or do not connect handlers to the SoupWebsocketConnection::pong signal in applications where Pong notifications are not required.
Where a handler is required, treat the incoming argument as GByteArray until the library is patched, matching the actual emitted type.
Terminate WebSocket sessions from untrusted peers at a reverse proxy or WAF that normalizes control frame payloads.

bash

# Verify installed libsoup version on RPM-based systems
rpm -q libsoup libsoup3

# Verify installed libsoup version on Debian-based systems
dpkg -l | grep -Ei 'libsoup(2\.4|-3\.0)'

# Apply vendor updates
sudo dnf update libsoup libsoup3   # RHEL / Fedora
sudo apt-get update && sudo apt-get install --only-upgrade libsoup2.4-1 libsoup-3.0-0   # Debian / Ubuntu