Critical Heap Buffer Overflow Vulnerabilities in libsoup Package
Summary
RLSA-2026:83384: Important: libsoup security update. Affects libsoup versions < 0:2.72.0-16.el9_8.8. Fixed in 0:2.72.0-16.el9_8.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libsoup is an HTTP client and server library designed for the GNOME desktop environment. It facilitates the development of applications that require web communication by providing a robust framework for handling HTTP requests and responses. However, recent vulnerabilities have been identified that expose the library to critical security risks, particularly in its WebSocket implementation.
Vulnerability Detail
The vulnerabilities in libsoup stem from multiple heap buffer overflow issues related to WebSocket handling. These vulnerabilities can be exploited through various attack vectors, leading to potential memory corruption, application crashes, or arbitrary code execution. Specifically, the vulnerabilities arise from type confusion during WebSocket Pong signal processing, message reassembly, receive-buffer growth, client-frame masking, and outgoing permessage-deflate buffer growth. The ramifications of these vulnerabilities are severe, with a CVSS score of 8.6 indicating a high level of risk.
How To Fix
Minimum fixed version
0:2.72.0-16.el9_8.8
This is the first release that contains the fix.
sudo dnf update libsoupTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable WebSocket functionality in applications that utilize libsoup until the package is updated. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The identified heap buffer overflow vulnerabilities in the libsoup package pose significant security risks to applications using this library. It is crucial for users to update to the latest patched version to mitigate these risks. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for libsoup →
FAQ
libsoup is an HTTP client and server library for the GNOME desktop environment, enabling applications to communicate over the web.
Heap buffer overflow vulnerabilities occur when a program writes more data to a buffer located on the heap than it can hold, potentially leading to memory corruption and security breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file, such as package-lock.json, to check for vulnerabilities.
The CVSS score for the vulnerabilities in libsoup is 8.6, indicating a high severity level.
Yes, Vulert provides a service that allows you to monitor and receive alerts for open-source vulnerabilities in real-time without requiring code access or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for libsoup.
