CVE-2026-102557 Libsoup: libsoup: heap buffer overflow during websocket message reassembly

A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used th...

CVE-2026-102557

A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used th...

CVE-2026-102557

A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used th...

CVE-2026-102557 Libsoup: libsoup: heap buffer overflow during websocket message reassembly

A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used th...

EUVD-2026-89032

A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used th...

CVE-2026-102557 Libsoup: libsoup: heap buffer overflow during websocket message reassembly

A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used th...

CVE-2026-102557

A heap buffer overflow exists in libsoup during the reassembly of fragmented WebSocket messages into a GByteArray . The vulnerability occurs because the implementation fails to adequately cap the total message size against the underlying buffer type's limits. A remote peer can send fragments that...

CVE-2026-102557

A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used th...

CVE-2026-102556 Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion

A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap...

CVE-2026-102556

A heap buffer overflow vulnerability exists in libsoup due to a signal type confusion during the handling of incoming WebSocket Pong frames. Specifically, SoupWebsocketConnection emits the ::pong signal with a GByteArray pointer despite being declared to pass a GBytes object. Applications that co...

EUVD-2026-89031

A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap...

CVE-2026-102556

A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap...

CVE-2026-102556 Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion

A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap...

CVE-2026-102556

A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap...

CVE-2026-102556 Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion

A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap...

CVE-2026-102556

A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap...

CLEANSTART-2026-WR14423 undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still ...

Security vulnerability affects the langfuse package. undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit...

CLEANSTART-2026-IF81553 undici's WebSocket client crashes the whole Node

Security vulnerability affects the langfuse package. undici's WebSocket client crashes the whole Node...

CLEANSTART-2026-TS74004 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason

Security vulnerability affects the apache-hive package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...

CLEANSTART-2026-WO79894 websocket-driver is a WebSocket protocol handler with pluggable I/O

Security vulnerability affects the argo-workflows package. websocket-driver is a WebSocket protocol handler with pluggable I/O...