CVE-2026-102559

A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.

This issue is rated Important. Triggering requires causing a libsoup WebSocket client (or client-role connection) to send an extremely large message. That may be reachable when application-level message size is attacker-influenced. Impact is heap corruption or denial of service in the sending process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this enforce application-level limits on outgoing WebSocket message sizes. Do not send untrusted bulk data as a single WebSocket message.