CVE-2026-102558 describes a heap buffer overflow in libsoup's SoupWebsocketConnection component. When the max-incoming-payload-size parameter is set to 0 (unlimited), the incoming GByteArray buffer can grow based on an attacker-controlled frame length. If the length value wraps due to integer overflow, this causes a heap buffer overflow while reading frame data. This vulnerability can be exploited remotely by a WebSocket peer without authentication or user interaction. The flaw can lead to heap corruption, denial of service, and potential low-level information disclosure such as memory contents that might aid further attacks. The vulnerability is rated with a CVSS 3.1 score of 8.6 (high severity). Red Hat's advisory emphasizes that default configurations with finite payload limits reduce exposure, but applications disabling this limit remain vulnerable. No official patch is explicitly stated in the advisory; mitigation is to avoid unlimited payload size and restrict WebSocket exposure.

An attacker controlling a remote WebSocket peer can cause heap corruption or denial of service by exploiting the heap buffer overflow triggered when the incoming payload size is unlimited. Confidentiality impact is low but may allow reading memory contents that could bypass protection mechanisms like ASLR. Integrity impact is low, but availability impact is high due to potential crashes or restarts. The vulnerability requires no privileges or user interaction and can be triggered over the network.

Red Hat advises configuring a finite max-incoming-payload-size on SoupWebsocketConnection instead of setting it to 0 (unlimited). Additionally, restrict WebSocket exposure to trusted peers to reduce risk. There is no explicit mention of an official patch or update; therefore, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.