Heap Buffer Overflow in Libsoup Affecting Red Hat Enterprise Linux and CentOS
CVE-2026-102559

8.6HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
29 September 2026

What is CVE-2026-102559?

A significant flaw has been identified in Libsoup, a library used for HTTP client implementations. This vulnerability arises during the construction of masked WebSocket client frames for sizable outgoing payloads. Specifically, the issue stems from size values passed to GByteArray allocation APIs, which can be truncated. Consequently, while the masking routine continues to utilize the complete length of the data, this discrepancy can lead to a heap buffer overflow, potentially allowing attackers to manipulate the application’s memory areas.

References

https://access.redhat.com/security/cve/CVE-2026-102559
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2543285
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Hongduo Zhao for reporting this issue.
.