Bug 2543295

Summary: CVE-2026-102560 mingw-libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth [fedora-all]
Product: [Fedora] Fedora Reporter: Srikanth Balasubramanian <sbalasub>
Component: mingw-libsoupAssignee: Kalev Lember <kalevlember>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: eblima, kalevlember, marcandre.lureau, rjones
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["d377f1f6-75f0-49a4-9d3d-08f2be3de3fc"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Srikanth Balasubramanian 2026-09-29 16:47:24 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A heap buffer overflow was found in libsoup's WebSocket permessage-deflate outgoing path.

soup_websocket_extension_deflate_process_outgoing_message() stored deflateBound()'s uLong result in a guint and grew a GByteArray by that amount. For payloads approaching 4 GiB, the bound exceeds G_MAXUINT; truncation allowed buffer->len + max_length to wrap on later growth, and zlib wrote through next_out past the allocation.

Fixed by refusing payloads whose compressed bound cannot fit in a GByteArray and by checking each incremental growth (commit dbd0417e, libsoup 3.7.3).

References:
https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554 (Bug 8)
https://gitlab.gnome.org/GNOME/libsoup/-/commit/dbd0417e