CVE-2026-102559: libsoup WebSocket Buffer Overflow Vulnerability

CVE-2026-102559 Overview

A heap buffer overflow exists in libsoup, the GNOME HTTP client and server library. The flaw occurs when the library constructs a masked WebSocket client frame for a large outgoing payload. Size values passed to GByteArray allocation APIs can be truncated, while the masking routine still uses the untruncated length. The mismatch causes the masking loop to write past the end of the allocated buffer, producing an out-of-bounds write on the heap [CWE-125].

Critical Impact
A network-reachable attacker or malicious server can trigger memory corruption in any application linked against libsoup that sends large WebSocket payloads, leading to process crashes and potential code execution.

Affected Products

libsoup (GNOME HTTP client/server library) — WebSocket client frame construction path
Red Hat Enterprise Linux distributions shipping affected libsoup packages
Applications and desktop components that depend on libsoup for WebSocket connectivity

Discovery Timeline

2026-09-29 - CVE CVE-2026-102559 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-102559

Vulnerability Analysis

The defect lives in the WebSocket client frame masking path of libsoup. When a caller submits a very large outgoing payload, the frame construction routine allocates a GByteArray sized by a value that is silently truncated as it crosses a narrower integer type. The subsequent masking loop still iterates over the full original length. Each iteration XORs a mask byte against a payload byte and writes the result into the undersized buffer, overwriting adjacent heap memory. The corruption is deterministic under attacker-controlled payload sizing, making it a reliable primitive against long-running clients that maintain WebSocket sessions with untrusted endpoints.

Root Cause

The underlying issue is a numeric truncation error. libsoup passes payload length through GByteArray allocation APIs whose size parameters are narrower than the caller's length type. The truncated length governs allocation, while the masking loop uses the original length. The two values disagree once the payload exceeds the type boundary, producing an out-of-bounds write [CWE-125] on the heap.

Attack Vector

Exploitation requires that a libsoup-based client open a WebSocket connection to an attacker-influenced endpoint and transmit a payload large enough to trigger truncation. The attack does not require authentication or user interaction beyond initiating the WebSocket session. Common exposure paths include desktop applications, messaging clients, and services that proxy or relay user content over WebSockets. No public proof-of-concept or in-the-wild exploitation has been reported at time of publication.

No verified public exploit code is available. Refer to the Red Hat CVE-2026-102559 Advisory and Red Hat Bug Report #2543285 for authoritative technical detail.

Detection Methods for CVE-2026-102559

Indicators of Compromise

Unexpected crashes or SIGABRT / SIGSEGV signals in processes linked against libsoup-2.4 or libsoup-3.0 shortly after WebSocket activity.
Glibc heap corruption diagnostics such as malloc(): corrupted top size or free(): invalid pointer in journal logs for libsoup consumers.
WebSocket sessions to untrusted hosts transmitting frames whose payload length crosses 32-bit boundaries.

Detection Strategies

Inventory installed libsoup versions across Linux endpoints and servers and compare against fixed package versions published by the distribution.
Enable AddressSanitizer or heap protection (MALLOC_CHECK_, GLIBC_TUNABLES=glibc.malloc.check=3) in development and staging builds of libsoup-linked applications to surface the overflow during testing.
Correlate application crash telemetry with outbound WebSocket connection metadata to identify triggering endpoints.

Monitoring Recommendations

Ingest system crash reports, coredumpctl output, and abrt events into a central log platform for correlation with process names that depend on libsoup.
Monitor egress connections using the WebSocket upgrade handshake to unusual or newly observed destinations.
Alert on repeated abnormal terminations of the same libsoup-linked binary across multiple hosts, which may indicate coordinated exploitation attempts.

How to Mitigate CVE-2026-102559

Immediate Actions Required

Apply the updated libsoup packages from your Linux distribution as soon as they become available and restart dependent services and desktop sessions to unload the vulnerable library.
Enumerate all applications that link against libsoup using lsof or ldd and prioritize patching hosts where those applications communicate with untrusted WebSocket endpoints.
Restrict outbound WebSocket connections from server workloads to an allowlist of known destinations until patches are deployed.

Patch Information

Refer to the Red Hat CVE-2026-102559 Advisory for the authoritative list of fixed package versions and the Red Hat Bug Report #2543285 for upstream patch tracking. Downstream distributions typically ship the same upstream fix in their libsoup-2.4 and libsoup-3.0 packages.

Workarounds

Where patching is delayed, block outbound WebSocket traffic to untrusted hosts at the perimeter or host firewall.
Configure applications that expose libsoup to user-controlled URLs to reject requests that would generate WebSocket payloads above a conservative size threshold.
Run affected services under systemd sandboxing (MemoryDenyWriteExecute=yes, SystemCallFilter) to limit post-exploitation options if the overflow is triggered.

bash

# Identify processes currently linked against libsoup on a Linux host
sudo lsof 2>/dev/null | grep -E 'libsoup-(2\.4|3\.0)\.so' | awk '{print $1, $2}' | sort -u

# Update libsoup on Red Hat family systems and restart affected services
sudo dnf update -y libsoup libsoup3
sudo systemctl restart <service-depending-on-libsoup>