CVE-2026-102559 is a High (CVSS 8.6) heap buffer overflow in libsoup. Building a masked WebSocket client frame for a very large payload truncates size values while masking uses the full length. Install your distribution update, such as RHSA-2026:83384 or 83618.
What's affected
The record gives the weakness as CWE-125 (out-of-bounds read), though the description talks of a heap buffer overflow in the masking step. Take the description as the guide to impact: heap corruption or denial of service in the sending process.
The record describes it this way. When libsoup builds a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation functions could be truncated, while the masking routine still used the full length. That mismatch writes past the end of the allocated array.
Red Hat rates it Important with CVSS 3.1 8.6, the same as the record. Its statement says triggering needs a libsoup WebSocket client, or a connection in the client role, to send an extremely large message, which may be reachable when the size of an application message is influenced by an attacker. Impact is heap corruption or denial of service in the sending process.
Red Hat's fixed packages, per its CVE data when we looked:
- Red Hat Enterprise Linux 10: libsoup3 3.6.5-3.el10_2.20, in RHSA-2026:83618.
- Red Hat Enterprise Linux 9: libsoup 2.72.0-16.el9_8.8, in RHSA-2026:83384.
- Red Hat Enterprise Linux 6 and 7 appear as out of support scope.
We did not confirm an upstream GNOME libsoup fixed release. Other distributions will have their own advisories.
How to check if you're exposed
Find which libsoup packages are installed.
rpm -q libsoup libsoup3
On Debian or Ubuntu, use the package manager instead.
dpkg -l | grep -i libsoup
Compare the result with your distribution's advisory. In containers, run the same query inside the image, since images often carry their own copy of libsoup. Applications that bundle GTK or GNOME components, such as some browsers and desktop apps, can pull it in.
Then think about exposure. The flaw is on the sending side of a WebSocket client. It matters where an application sends very large messages whose size an outside party can influence.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Install your distribution update. On RHEL, apply RHSA-2026:83384 for RHEL 9 or RHSA-2026:83618 for RHEL 10.
- Scan container images for libsoup and rebuild any that carry an old copy.
- Restart applications that use libsoup after the update, since running processes keep the old library in memory.
- Set limits on message size where your application sends data to WebSocket servers and the size comes from outside input.
- For other distributions, check their security tracker for a fixed package.
Why it matters
Integer truncation bugs happen when a size is stored in a smaller type in one place and a larger type in another. The allocation is made with the small value, and the copy or mask loop uses the big one. The result is a write beyond the buffer.
It needs a very large message, so it is rarely triggered by accident. The record does not mark the CVE as known exploited. Even so, libsoup sits under many desktop and server applications, so the practical task is making sure the library is updated everywhere it hides.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this reachable from the network?
The record scores it as network reachable, but Red Hat notes that the client must be made to send an extremely large message, which depends on the application.
Why does the CWE say out-of-bounds read?
The record lists CWE-125 while the description talks about a heap buffer overflow. The impact in the description, heap corruption or denial of service, is what to plan for.
Sources
Last reviewed: 18 October 2026.
