Critical Security Flaw in libsoup3: Heap Buffer Overflow Vulnerabilities
Summary
ALSA-2026:83618: Important: libsoup3 security update. Affects libsoup3 versions < 3.6.5-3.el10_2.20. Fixed in 3.6.5-3.el10_2.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libsoup is an HTTP library implementation in C, designed to facilitate asynchronous communication for GNOME applications. It allows these applications to access HTTP servers efficiently, leveraging the Glib main loop. The library has undergone significant changes, separating SOAP functionalities from its core, focusing on HTTP operations. However, recent vulnerabilities have been identified that could compromise the security of applications utilizing libsoup3.
Vulnerability Detail
The vulnerabilities in libsoup3 stem from multiple heap buffer overflow issues, primarily related to WebSocket handling and data-URI base64 decoding. These flaws can lead to potential exploitation, allowing attackers to execute arbitrary code, crash applications, or cause data corruption. The specific vulnerabilities include uninitialized length in data-URI decoding, type confusion in WebSocket Pong signals, and issues during message reassembly and buffer growth, all of which could severely impact application stability and security.
How To Fix
Minimum fixed version
3.6.5-3.el10_2.20
This is the first release that contains the fix.
sudo dnf update libsoup3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for these vulnerabilities. The best course of action is to apply the available security updates as soon as possible.
Conclusion
The identified vulnerabilities in libsoup3 pose significant risks to applications relying on this library for HTTP communication. It is imperative to update to the latest patched version to safeguard against potential exploitation. Regular monitoring and prompt updates are essential for maintaining application security.
See every vulnerability recorded for libsoup3 →
FAQ
Libsoup3 is an HTTP library in C that allows GNOME applications to communicate with HTTP servers asynchronously.
Heap buffer overflow vulnerabilities occur when a program writes more data to a buffer than it can hold, potentially leading to arbitrary code execution or application crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
While there are no specific workarounds, it is crucial to prioritize updating libsoup3 to mitigate the risks associated with these vulnerabilities.
For detailed information about the security issues, refer to the CVE pages listed in the related section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup3.
