EUVD-2026-89031
GHSA-q4x2-vf8m-46j5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Network-triggered via crafted Pong with no auth or interaction, but AC:H because it only fires when the app registers a documented GBytes ::pong handler; impact is chiefly crash/corruption (A:H, C:L/I:L).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
4DescriptionCVE.org
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.
Articles & Coverage 1
AnalysisAI
A type-confusion memory-safety flaw in libsoup's WebSocket handling can crash or corrupt the heap of applications that process incoming Pong frames. When a Pong frame arrives, SoupWebsocketConnection emits its ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes object, so any application that connects a ::pong handler written to the documented GBytes API will misinterpret the payload and may suffer heap corruption or a crash. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application built on libsoup act as a WebSocket peer AND register a handler on the SoupWebsocketConnection ::pong signal that reads the payload via the documented GBytes API; only then does the type mismatch (GByteArray delivered as GBytes) corrupt memory when a crafted Pong frame arrives. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) presents this as a network-reachable, unauthenticated, no-interaction flaw with high availability impact - which on its face is a real priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch is identified at time of analysis, so the primary action is to track the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-102556) and Bugzilla entry (https://bugzilla.redhat.com/show_bug.cgi?id=2543229) for the exact fixed libsoup package versions and apply them once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
No vendor-released patch identified at time of analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today