OESA-2026-3780 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A vulnerability was found in libsoup's WebSocket frame parsing implementation...

Important: libsoup3

Issue Overview: A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 SS5.5, which mandates that all WebSocket control frames e.g., PING, PONG, CLOSE contain a payload of 125 bytes or less. A remote,...

Amazon Linux 2023 : libsoup3, libsoup3-devel (ALAS2023-2026-2087)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2087 advisory. A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 SS5.5, which mandates that all WebSocket control frames...

Important: libsoup

Issue Overview: A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 SS5.5, which mandates that all WebSocket control frames e.g., PING, PONG, CLOSE contain a payload of 125 bytes or less. A remote,...

Important: libsoup

Issue Overview: A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 SS5.5, which mandates that all WebSocket control frames e.g., PING, PONG, CLOSE contain a payload of 125 bytes or less. A remote,...

Amazon Linux 2023 : libsoup, libsoup-devel (ALAS2023-2026-2086)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2086 advisory. A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 SS5.5, which mandates that all WebSocket control frames...

AZL-92400 CVE-2026-15711 affecting package libsoup 3.4.4-16

A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames e.g., PING, PONG, CLOSE contain a payload of 125 bytes or less. A remote, unauthenticated attacker...

Linux Distros Unpatched Vulnerability : CVE-2026-44546

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not...

CVE-2026-10099

XX-Net V5.16.6 contains a WebSocket frame parsing vulnerability in the WebSocketreceiveworker routine of simplehttpserver.py that allows attackers to cause corrupted application data by sending unmasked WebSocket frames. The server unconditionally reads 4 bytes as a masking key regardless of...

CVE-2026-10099

XX-Net version 5.16.6 is affected by a WebSocket frame parsing vulnerability in the WebSocket_receive_worker routine of simple_http_server.py. The issue arises because the server unconditionally reads 4 bytes as a masking key regardless of the MASK bit in the frame header, causing the first 4 byt...

accumulator (0.3.0), bing-rs (>=0.0.2, <=0.0.4) +47 more potentially affected by CVE-2020-35896 via ws (>=0.4.8, <=0.8.1)

ws CARGO version =0.4.8, =0.0.2, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =11.0.0, =0.5.0, =0.2.6, =0.2.9 - magic-wormhole 0.0.1 and more Source cves: CVE-2020-35896 Source advisory: OSV:GHSA-RH7X-PPXX-P34C...