CVE-2026-102557

A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.

This issue is rated Important. A remote, unauthenticated WebSocket peer can trigger heap corruption or denial of service during message reassembly. Any Red Hat product or application exposing or consuming libsoup WebSockets with untrusted peers is affected until updated.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this set a conservative max-total-incoming-message-size / incoming payload limits where the API allows, and do not accept WebSocket connections from untrusted peers.