The libsoup library contains a flaw in its WebSocket implementation where the SoupWebsocketConnection emits the ::pong signal with a GByteArray pointer, despite the signal being declared to pass a GBytes object. Applications that connect a handler following the documented GBytes API may trigger heap corruption or a crash when receiving a specially crafted WebSocket Pong frame. This type confusion leads to potential memory corruption, causing process crashes or heap state corruption. The vulnerability is remotely exploitable without privileges or user interaction, affecting client and server applications using libsoup WebSocket support on Red Hat platforms.

A remote attacker can send a crafted WebSocket Pong frame to an application using libsoup that connects a ::pong handler expecting GBytes, causing heap corruption or a crash. This can lead to denial of service or potentially unauthorized code execution due to memory corruption. The vulnerability impacts confidentiality, integrity, and availability with a high severity score (CVSS 8.6).

Red Hat advises avoiding connecting custom handlers to the SoupWebsocketConnection::pong signal or avoiding WebSocket use with untrusted peers until a fix is available. No official patch or fix status is explicitly stated in the advisory, so patch status is not yet confirmed—check the vendor advisory for updates. Applying these mitigations reduces the risk of exploitation.