Critical Security Flaw in libsoup3: Remote Denial of Service and Heap Vulnerability
Summary
ALSA-2026:68235: Important: libsoup3 security update. Affects libsoup3 versions < 3.6.5-3.el10_2.14. Fixed in 3.6.5-3.el10_2.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libsoup is an HTTP library implementation in C, designed to facilitate asynchronous HTTP requests in GNOME applications. It integrates seamlessly with the Glib main loop and is tailored for GTK applications, allowing developers to access HTTP servers efficiently. However, recent vulnerabilities have exposed libsoup3 to significant security risks, necessitating immediate attention from users and developers alike.
Vulnerability Detail
The vulnerabilities in libsoup3 include a remote denial of service (DoS) due to unbounded decompression in the WebSocket permessage-deflate extension (CVE-2026-15709), a DoS via oversized control frame protocol violations in the WebSocket connection (CVE-2026-15711), and a heap use-after-free issue in the HTTP/2 client during body uploads (CVE-2026-85197). These vulnerabilities can lead to application crashes and potential exploitation by malicious actors.
How To Fix
Minimum fixed version
3.6.5-3.el10_2.14
This is the first release that contains the fix.
sudo dnf update libsoup3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the size of WebSocket messages and control frames to mitigate the risk of denial of service attacks until the package is updated. However, this is not a permanent solution and updating is strongly recommended.
Conclusion
The vulnerabilities in libsoup3 pose significant risks to applications relying on this library for HTTP communication. It is crucial for developers and users to update to the latest patched version to safeguard against potential exploits. Temporary workarounds can mitigate risks, but they should not replace a proper update.
See every vulnerability recorded for libsoup3 →
FAQ
Libsoup3 is an HTTP library in C that allows GNOME applications to communicate with HTTP servers asynchronously.
The main vulnerabilities include remote denial of service attacks and a heap use-after-free issue, which can lead to application crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, consider implementing message size limits as a temporary workaround to reduce risk.
For detailed information, refer to the CVE pages linked in the advisory or consult the official libsoup documentation.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup3.
