Security
Loading…

CVE-2026-102556

HIGHCVSS 8.6
View on NVD← Back to search
Description

A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.

Timeline
Published:September 29th, 2026 5:17 PM
Last modified:November 4th, 2026 10:17 PM
CVSS Scoring

CVSS v3: 8.6 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Affected Software
From NVD CPE configuration data

Vendors

gnomeredhat

Products

libsoupenterprise_linux
Weaknesses (CWE)
CWE-843
References & Reports
Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute