Bug 2543229 (CVE-2026-102556) - CVE-2026-102556 libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion
Summary: CVE-2026-102556 libsoup: libsoup: Heap buffer overflow from WebSocket Pong si...
Keywords:
Status: NEW
Alias: CVE-2026-102556
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2543264 2543267 2543266
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-29 14:53 UTC by OSIDB Bzimport
Modified: 2026-11-11 11:50 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2026:87453 0 None None None 2026-10-22 02:30:13 UTC
Red Hat Product Errata RHSA-2026:83384 0 None None None 2026-10-15 02:58:54 UTC
Red Hat Product Errata RHSA-2026:83618 0 None None None 2026-10-15 15:54:07 UTC
Red Hat Product Errata RHSA-2026:84586 0 None None None 2026-10-19 04:01:57 UTC
Red Hat Product Errata RHSA-2026:92347 0 None None None 2026-10-29 11:08:30 UTC
Red Hat Product Errata RHSA-2026:93445 0 None None None 2026-11-02 02:28:32 UTC
Red Hat Product Errata RHSA-2026:93446 0 None None None 2026-11-02 03:33:56 UTC
Red Hat Product Errata RHSA-2026:93447 0 None None None 2026-11-02 02:36:00 UTC
Red Hat Product Errata RHSA-2026:93465 0 None None None 2026-11-02 03:31:01 UTC
Red Hat Product Errata RHSA-2026:93466 0 None None None 2026-11-02 03:33:48 UTC
Red Hat Product Errata RHSA-2026:93583 0 None None None 2026-11-02 08:58:18 UTC
Red Hat Product Errata RHSA-2026:93716 0 None None None 2026-11-02 12:47:00 UTC
Red Hat Product Errata RHSA-2026:98453 0 None None None 2026-11-11 11:50:56 UTC
Red Hat Product Errata RHSA-2026:98560 0 None None None 2026-11-11 11:19:23 UTC

Description OSIDB Bzimport 2026-09-29 14:53:18 UTC 
A type-confusion heap overflow was found in libsoup's WebSocket Pong handling.

SoupWebsocketConnection::pong is declared to deliver a GBytes payload, but receive_pong() emitted a GByteArray pointer via g_signal_emit() and then unreffed the GByteArray. Handlers that treated the argument as GBytes (as documented) operated on the wrong object layout, resulting in heap memory corruption / overflow conditions under ASan.

Fixed upstream by converting the buffer with g_byte_array_free_to_bytes() before emission (commit d2cbaf25, libsoup 3.7.3).

References:
https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554 (Bug 2)
https://gitlab.gnome.org/GNOME/libsoup/-/commit/d2cbaf25
Comment 2 Jon Orris 2026-10-15 02:58:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:83384 https://access.redhat.com/errata/RHSA-2026:83384
Comment 3 Jon Orris 2026-10-15 15:54:06 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:83618 https://access.redhat.com/errata/RHSA-2026:83618
Comment 4 Jon Orris 2026-10-19 04:01:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:84586 https://access.redhat.com/errata/RHSA-2026:84586
Comment 5 Jon Orris 2026-10-29 11:08:29 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:92347 https://access.redhat.com/errata/RHSA-2026:92347
Comment 6 Jon Orris 2026-11-02 02:28:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:93445 https://access.redhat.com/errata/RHSA-2026:93445
Comment 7 Jon Orris 2026-11-02 02:35:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:93447 https://access.redhat.com/errata/RHSA-2026:93447
Comment 8 Jon Orris 2026-11-02 03:31:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:93465 https://access.redhat.com/errata/RHSA-2026:93465
Comment 9 Jon Orris 2026-11-02 03:33:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:93466 https://access.redhat.com/errata/RHSA-2026:93466
Comment 10 Jon Orris 2026-11-02 03:33:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:93446 https://access.redhat.com/errata/RHSA-2026:93446
Comment 11 Jon Orris 2026-11-02 08:58:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:93583 https://access.redhat.com/errata/RHSA-2026:93583
Comment 12 Jon Orris 2026-11-02 12:46:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:93716 https://access.redhat.com/errata/RHSA-2026:93716
Comment 13 errata-xmlrpc 2026-11-11 11:19:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:98560 https://access.redhat.com/errata/RHSA-2026:98560
Comment 14 errata-xmlrpc 2026-11-11 11:50:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:98453 https://access.redhat.com/errata/RHSA-2026:98453
Note You need to log in before you can comment on or make changes to this bug.