CVE-2026-102558

A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.

This issue is rated Important. A remote WebSocket peer can cause heap corruption or denial of service, especially when applications leave incoming payload size unlimited. Default configurations that set a finite max-incoming-payload-size reduce exposure but the vulnerable code path remains relevant for applications that disable the limit.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this configure a finite max-incoming-payload-size (do not set it to 0/unlimited) on SoupWebsocketConnection. Restrict WebSocket exposure to trusted peers.