EUVD-2026-89103
GHSA-xxgh-qh6h-jxc2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Remote unauthenticated peer (AV:N/PR:N/UI:N) but AC:H because the non-default unlimited-payload config plus a length-wrapping large transfer must both hold; impact is chiefly availability (heap corruption crash).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
4DescriptionCVE.org
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.
Articles & Coverage 1
AnalysisAI
Heap out-of-bounds read in libsoup's WebSocket implementation allows a remote, unauthenticated peer to trigger a heap buffer overflow when the application has configured max-incoming-payload-size to unlimited (0), a non-default setting; with the standard payload cap the overflow cannot be reached. The CVSS 3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), but our assessed vector raises complexity to AC:H because exploitation requires both the non-default unlimited setting and a frame large enough to wrap the GByteArray length counter, implying a very large transfer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the libsoup-based application to have explicitly configured the WebSocket connection with max-incoming-payload-size set to unlimited (0), which is NOT the default; with the default size cap, the overflow cannot be reached. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, score 8.6) presents this as a network, low-complexity, unauthenticated flaw, but the description reveals a significant precondition that the vector's AC:L understates: the heap overflow only occurs when the application has configured max-incoming-payload-size to unlimited (0), which is NOT the libsoup default (a size cap normally exists). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; monitor https://access.redhat.com/security/cve/CVE-2026-102558 and https://bugzilla.redhat.com/show_bug.cgi?id=2543274 for fixed libsoup package versions and apply them via the normal Red Hat update channels when available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications using libsoup's WebSocket implementation and confirm whether max-incoming-payload-size is set to unlimited (0); where it is, immediately reconfigure it to a finite cap and restrict WebSocket exposure to trusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today