Moderate Security Vulnerability in libsoup: WebSocket Remote Denial of Service
Summary
ALSA-2026:68266: Moderate: libsoup security update. Affects libsoup versions < 2.62.3-15.el8_10. Fixed in 2.62.3-15.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libsoup is an HTTP client and server library designed for the GNOME desktop environment. It provides developers with a robust framework for handling HTTP requests and responses, making it a critical component for applications that rely on web communication. The library supports various features, including WebSocket connections, which allow for real-time communication between clients and servers. However, a recent vulnerability has been identified that could potentially compromise the stability of applications using this library.
Vulnerability Detail
The vulnerability in libsoup, identified as CVE-2026-15711, arises from a flaw in the handling of WebSocket connections. Specifically, it allows for a remote denial of service (DoS) attack through the exploitation of oversized control frames. An attacker could craft a malicious WebSocket connection that sends oversized control frames, leading to a crash or unresponsive state in the application. This vulnerability poses a significant risk to applications relying on libsoup for real-time communication, as it could be exploited to disrupt service availability.
How To Fix
Minimum fixed version
2.62.3-15.el8_10
This is the first release that contains the fix.
sudo dnf update libsoupTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the size of WebSocket control frames in your application to mitigate the risk of this vulnerability. However, the best course of action is to apply the security update as soon as possible.
Conclusion
The libsoup library has a moderate security vulnerability that could allow for remote denial of service attacks through oversized WebSocket control frames. It is crucial for developers and system administrators to update their libsoup packages to the latest patched version to ensure the security and stability of their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for libsoup →
FAQ
CVE-2026-15711 is a security vulnerability in libsoup that allows for a remote denial of service attack via oversized WebSocket control frames.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability can lead to application crashes or unresponsive states, affecting the availability and reliability of services that depend on libsoup.
Yes, a patch is available in version 2.62.3-15.el8_10 of libsoup. Updating to this version will resolve the vulnerability.
If immediate updates are not possible, consider implementing restrictions on WebSocket control frame sizes as a temporary workaround until you can apply the security patch.
Related vulnerabilities
Recent vulnerabilities recorded for libsoup.
