Critical Heap Buffer Overflow Vulnerabilities in libsoup Package
Summary
RLSA-2026:84586: Important: libsoup security update. Affects libsoup versions < 0:2.62.3-19.el8_10. Fixed in 0:2.62.3-19.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libsoup is an HTTP client and server library designed for the GNOME desktop environment. It provides essential functionalities for web communication, enabling applications to send and receive HTTP requests and responses. The library is widely used in various applications, making it crucial for developers to ensure its security and stability. Recent vulnerabilities have been identified that could potentially compromise the integrity of applications relying on libsoup.
Vulnerability Detail
The libsoup package has been found to contain multiple heap buffer overflow vulnerabilities, specifically related to WebSocket operations. These vulnerabilities arise from signal type confusion, message reassembly issues, receive-buffer growth, and client-frame masking. If exploited, these vulnerabilities could allow attackers to execute arbitrary code, leading to severe security breaches and data loss. The vulnerabilities are cataloged under CVEs: CVE-2026-102556, CVE-2026-102557, CVE-2026-102558, and CVE-2026-102559, with a CVSS score of 8.6 indicating a high severity level.
How To Fix
Minimum fixed version
0:2.62.3-19.el8_10
This is the first release that contains the fix.
sudo dnf update libsoupTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of WebSocket features in applications that depend on libsoup until the package is updated. This can help mitigate the risk of exploitation while waiting for the official patch.
Conclusion
The libsoup package has critical vulnerabilities that need immediate attention. Users are strongly advised to update to the latest patched version to safeguard their applications. By understanding the nature of these vulnerabilities and taking appropriate action, developers can protect their systems from potential threats.
See every vulnerability recorded for libsoup →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, potentially leading to memory corruption and security vulnerabilities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities in real-time.
Exploitation of these vulnerabilities could allow attackers to execute arbitrary code, leading to unauthorized access, data breaches, and potential system compromise.
Yes, temporarily limiting the use of WebSocket features in applications that rely on libsoup can help mitigate the risk until the patch is applied.
Detailed information about the vulnerabilities can be found on the CVE pages listed in the references section of the security advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for libsoup.
