What happened
A vulnerability has been identified in the libsoup library, specifically in relation to the handling of the permessage-deflate WebSocket extension. When this extension compresses a very large outgoing message, due to truncated size calculations used for GByteArray growth, a wrap-around can occur. This condition may cause zlib to write past the allocated buffer, resulting in a heap buffer overflow. The flaw has been assigned CVE-2026-102560 and has a CVSS base score of 8.6, indicating high severity, though it is assessed as medium due to uncertainties about exploited potential. The vulnerability allows remote attackers to potentially cause a memory corruption that could lead to remote code execution. Exploiting this flaw involves directly attacking exposed network services without requiring user interaction or prior access, increasing its impact and reach. Evidence suggests that the flaw impacts multiple versions of Red Hat Enterprise Linux, including versions 6, 7, 8, 9, and 10.
Who is affected
Organisations running affected versions of Red Hat Enterprise Linux that include the vulnerable libsoup component are at risk. This includes deployments operating in environments where the WebSocket service is exposed to network access. The vulnerability impacts any system where the permessage-deflate WebSocket extension is used with large outgoing messages, and where the libsoup library is present. Due to the nature of the attack vector, any exposed service relying on this library can be targeted without prior access or user interaction, increasing the potential impact across affected deployments.
Recommended actions
- Mitigations should focus on reducing network exposure to the vulnerable services. Implement network segmentation and access controls to restrict incoming connections.
- Monitor for any signs of abnormal behaviour or potential exploitation attempts targeting WebSocket services.
- Apply security updates as soon as patches or mitigations become available from the vendor or maintainers of affected Linux distributions.
Indicators of compromise
At this time, no specific indicators of compromise have been provided for this vulnerability.
