CVE-2026-102560: libsoup Buffer Overflow Vulnerability

CVE-2026-102560 Overview

A heap buffer overflow vulnerability exists in libsoup, the HTTP client/server library used by GNOME applications and other Linux software. The flaw occurs when the permessage-deflate WebSocket extension compresses a very large outgoing message. Truncated size calculations used for GByteArray growth can wrap, causing zlib to write past the allocated buffer. An attacker capable of triggering large compressed WebSocket messages can corrupt heap memory in the affected process.

Critical Impact
Remote attackers can trigger a heap buffer overflow via crafted WebSocket traffic, leading to memory corruption, process crashes, and potential code execution paths in libsoup-based applications.

Affected Products

GNOME libsoup HTTP library with WebSocket support
Applications linking against libsoup and using the permessage-deflate WebSocket extension
Linux distributions shipping vulnerable libsoup packages (see Red Hat advisory for specific versions)

Discovery Timeline

2026-09-29 - CVE CVE-2026-102560 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-102560

Vulnerability Analysis

The vulnerability resides in the WebSocket permessage-deflate compression path within libsoup. When outgoing messages are compressed by zlib, the library uses a GByteArray to hold the deflated payload and dynamically grows it as compression produces output. The size accounting used to compute the required growth performs arithmetic on truncated types.

When the outgoing payload is very large, these calculations wrap around, producing a smaller-than-required allocation. zlib then writes compressed bytes beyond the end of the allocated heap buffer. The condition maps to [CWE-125] class memory safety issues and results in a heap buffer overflow reachable from network-controlled input.

Because WebSocket messages traverse standard HTTP upgrade sessions, no authentication or user interaction is required to reach the affected code path in a vulnerable server or client that negotiates permessage-deflate.

Root Cause

The root cause is an integer truncation in the size calculations that drive GByteArray growth during deflate compression. When the target size exceeds the range of the truncated integer type, the value wraps and libsoup requests an under-sized allocation before handing the buffer to zlib.

Attack Vector

An attacker sends or induces a libsoup-based peer to emit a very large WebSocket message over a session that negotiated the permessage-deflate extension. Compression of the oversized payload triggers the wrap and the subsequent out-of-bounds heap write. Details are described in the Red Hat CVE-2026-102560 Advisory and Red Hat Bug Report #2543296.

Detection Methods for CVE-2026-102560

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linked against libsoup that handle WebSocket traffic.
Heap corruption signatures from AddressSanitizer or glibc malloc checks referencing zlib deflate frames.
WebSocket sessions negotiating permessage-deflate followed by anomalously large outgoing messages from the client or server.

Detection Strategies

Inventory installed libsoup versions across Linux endpoints and servers and compare against vendor fixed versions.
Monitor for abnormal process termination or restart loops in GNOME applications, feed readers, or servers using libsoup WebSockets.
Enable core dump collection on libsoup-dependent services and review crash traces referencing soup_websocket_* or deflate symbols.

Monitoring Recommendations

Ingest system logs, systemd-coredump events, and application crash reports into a centralized logging or SIEM platform.
Alert on repeated crashes of the same libsoup-linked process, which may indicate exploitation attempts against WebSocket endpoints.
Track outbound and inbound WebSocket sessions for oversized frames on services that expose libsoup to untrusted networks.

How to Mitigate CVE-2026-102560

Immediate Actions Required

Apply vendor-supplied libsoup updates as soon as they are available for your distribution.
Restart all services and desktop sessions that link libsoup so the patched library is loaded into running processes.
Restrict exposure of libsoup-based WebSocket servers to trusted networks until patched.

Patch Information

Refer to the Red Hat CVE-2026-102560 Advisory for fixed package versions and errata. Track your distribution's security channel for the corresponding libsoup update and rebuild any statically linked or vendored copies.

Workarounds

Disable the permessage-deflate WebSocket extension in applications where negotiation can be controlled.
Enforce upper bounds on outgoing WebSocket message sizes at the application layer to avoid the wrap condition.
Terminate untrusted WebSocket traffic at a reverse proxy that does not forward permessage-deflate negotiation until patches are deployed.

bash

# Check installed libsoup version on RPM-based systems
rpm -q libsoup libsoup3

# Check installed libsoup version on Debian-based systems
dpkg -l | grep -i libsoup

# Apply vendor updates
sudo dnf update libsoup libsoup3   # RHEL / Fedora
sudo apt update && sudo apt upgrade libsoup2.4-1 libsoup-3.0-0   # Debian / Ubuntu