CVE-2026-102556: Access of Resource Using Incompatible Type

A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap...

CVE-2026-102560: Out-of-bounds Read

A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow...

PT-2026-108566

Security vulnerability affects the argo-workflows package. websocket-driver is a WebSocket protocol handler with pluggable I/O...

CVE-2026-102559: Out-of-bounds Read

A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow...

PT-2026-102680

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw exists when reassembling fragmented WebSocket messages into a GByteArray. The software fails to adequately cap the total message size against the limits of the underlying buffer type. ...

CVE-2026-102560: Out-of-bounds Read

A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow...

PT-2026-102754

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw exists when constructing a masked WebSocket client frame for very large outgoing payloads. Size values passed to GByteArray allocation APIs may be truncated, while the masking routine...

PT-2026-102679

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw exists in libsoup where SoupWebsocketConnection emits the ::pong signal using a GByteArray pointer instead of the documented GBytes. Applications that implement a handler following the...

CVE-2026-102557: Out-of-bounds Read

A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used th...

PT-2026-102755

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw exists in the permessage-deflate WebSocket extension. When compressing a very large outgoing message, truncated size calculations used for GByteArray growth can wrap, leading zlib to...

CVE-2026-102557: Out-of-bounds Read

A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used th...

CVE-2026-102556: Access of Resource Using Incompatible Type

A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap...

Important: libsoup3

Issue Overview: The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the integer overflow guard inside the if masked block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64MAX to trigge...

CVE-2026-102559: Out-of-bounds Read

A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow...

Linux Distros Unpatched Vulnerability : CVE-2026-102560

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for...

Linux Distros Unpatched Vulnerability : CVE-2026-102556

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even...

Amazon Linux 2023 : libsoup3, libsoup3-devel (ALAS2023-2026-3144)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3144 advisory. The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the integer overflow guard inside the if masked block, leaving unmasked server-to-client frames unprotected. A malicious WebSocke...

Linux Distros Unpatched Vulnerability : CVE-2026-102559

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation AP...

Linux Distros Unpatched Vulnerability : CVE-2026-102557

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the...

Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-3123)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3123 advisory. undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connecti...