EUVD-2026-89105
GHSA-9v45-6jmj-gmwr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Network-reachable via WebSocket with no auth (PR:N), but AC:H because the integer wrap only triggers on a very large outgoing message; heap overflow yields crash (A:H) with limited C/I exposure.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
4DescriptionCVE.org
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
Articles & Coverage 1
AnalysisAI
Heap buffer overflow in libsoup's WebSocket permessage-deflate compression can be triggered when a very large outgoing message is compressed, allowing a remote unauthenticated attacker to cause a denial of service and potentially limited data disclosure or modification. The flaw affects libsoup as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10; the independent assessment rates attack complexity as high because triggering requires a multi-gigabyte-scale message, making casual exploitation unlikely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the permessage-deflate WebSocket extension to be negotiated/enabled on a libsoup-based endpoint, AND a VERY LARGE outgoing message (approaching the point where 32-bit-style size calculations wrap during GByteArray growth) to be compressed and sent. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, base 8.6) frames this as a remote, unauthenticated, low-complexity heap buffer overflow with high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; monitor https://access.redhat.com/security/cve/CVE-2026-102560 and https://bugzilla.redhat.com/show_bug.cgi?id=2543296 for updated libsoup packages and apply them as soon as they are available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all RHEL 6, 7, 8, 9, and 10 systems and container images that depend on libsoup, and identify which of them expose WebSocket endpoints using permessage-deflate to untrusted networks; there is no vendor-released patch identified at time of analysis, so interim mitigations must be prioritized immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today