EUVD-2026-89104
GHSA-cj4p-f4hv-cp74
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
AC:H because triggering the truncation requires a ~4 GiB outgoing payload the attacker rarely controls; heap overflow gives memory-corruption I:H/A:H with limited C:L.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
4DescriptionCVE.org
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
Articles & Coverage 1
AnalysisAI
Heap memory corruption in libsoup can be triggered when a WebSocket client using libsoup constructs a masked outgoing frame for an extremely large payload near the 32-bit guint limit, truncating the GByteArray allocation size while the masking routine processes the full length. It affects libsoup as shipped in Red Hat Enterprise Linux 6 through 10. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a libsoup-based WebSocket CLIENT to construct and send a MASKED outgoing frame whose payload is large enough (~4 GiB, near the 32-bit guint limit) to truncate the size passed to GByteArray allocation APIs while the masking routine still processes the full length. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals conflict between the raw CVSS score and realistic exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; consult the Red Hat CVE page at https://access.redhat.com/security/cve/CVE-2026-102559 and Bugzilla 2543285 at https://bugzilla.redhat.com/show_bug.cgi?id=2543285 for updated libsoup errata for RHEL 6 through 10, and apply vendor updates when they are released. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all RHEL 6, 7, 8, 9, and 10 systems running libsoup and identify any externally reachable WebSocket clients or services; apply firewall rules or network segmentation to restrict untrusted access to those endpoints and monitor for crashes or unusual memory consumption. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today