What’s Vulnerable › Vulnerabilities

CVE-2026-102560: Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-29 · updated 2026-10-22
• Weakness: CWE-125

Description

A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.

Affected products

• GNOME libsoup: before 3.7.3 — fixed in 3.7.3
• Red Hat Enterprise Linux: 7.0, 8.0, 9.0, 10.0

How to fix

Upgrade to a fixed version: GNOME libsoup 3.7.3. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:83384
• https://access.redhat.com/errata/RHSA-2026:83618
• https://access.redhat.com/security/cve/CVE-2026-102560
• https://bugzilla.redhat.com/show_bug.cgi?id=2543296

Get alerted when CVE-2026-102560 or the next vulnerability affects your stack