CVE-2026-102560 is a high severity (CVSS 8.6) heap buffer overflow in GNOME libsoup. Compressing a very large outgoing WebSocket message with permessage-deflate can make a size calculation wrap and let zlib write past the buffer. Apply your vendor's update. Red Hat suggests disabling deflate and capping message sizes meanwhile.
What's affected
The record lists GNOME libsoup and Red Hat Enterprise Linux. Red Hat rates it Important and links the errata RHSA-2026:83384 and RHSA-2026:83618. Which one applies depends on your RHEL release, so read both. The record gives no upstream fixed version, so check the libsoup project and your distribution.
Red Hat's statement narrows the exposure: the permessage-deflate extension must be negotiated, and a very large outgoing message must be compressed. Applications that enable WebSocket deflate with untrusted or unbounded message sizes are affected.
How to check if you're exposed
See which libsoup packages you have:
rpm -q libsoup libsoup3
dpkg -l | grep -i libsoup
apk info | grep -i libsoup
In containers, scan the image as well as the host, since many base images carry libsoup for desktop or GNOME software. Then find applications that use libsoup's WebSocket support with deflate enabled and ask whether outgoing message size is bounded.
What to do now
- Apply the update your distribution provides. On RHEL, check RHSA-2026:83384 and RHSA-2026:83618.
- Where you cannot update, disable the permessage-deflate WebSocket extension if you do not need it (Red Hat's mitigation).
- Cap the size of outgoing WebSocket messages in applications that use libsoup.
- Scan container images for libsoup and rebuild the ones that carry it.
- Restart services that use the library after the update, since a running process keeps the old copy loaded.
Why it matters
The record describes a size calculation that was truncated, so a value used to grow a GByteArray could wrap around. A wrapped size means the buffer is smaller than zlib believes, and zlib writes past it. The record files it under CWE-125 (out-of-bounds read), although the description speaks of a write past the buffer, so expect scanners to label it differently.
Red Hat's impact statement is heap corruption or denial of service. Red Hat's page also shows NVD scoring it 9.8 against Red Hat's own 8.6, so you may see different numbers from different sources.
The record gives no sign of exploitation in the wild and the KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
How likely is it that I am exposed?
Less likely than the score suggests. Red Hat says exploitation needs permessage-deflate to be negotiated and a very large outgoing message to be compressed. Check whether any of your applications do both.
Sources
Last reviewed: 19 October 2026.
