CVE-2026-102556

A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.

This issue is rated Important. A remote peer can send a WebSocket Pong that reaches receive_pong(). Exploitation requires an application to connect a ::pong handler that expects GBytes; many keep-alive users do. Successful triggering can crash the process or corrupt heap state. libsoup WebSocket support is used by client and server applications on Red Hat platforms.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate avoid connecting custom handlers to SoupWebsocketConnection::pong, or avoid WebSocket use with untrusted peers.