CVE-2026-102557 describes a vulnerability in libsoup where fragmented WebSocket messages are reassembled into a GByteArray without adequately capping the total message size against the underlying buffer limits. This improper size capping can cause size truncation while the implementation still uses the full length, resulting in heap corruption or a crash. The flaw can be triggered remotely by an unauthenticated WebSocket peer, potentially causing denial of service or leaking memory contents. The vulnerability is classified under CWE-125 (Out-of-bounds Read) and has a CVSS v3.1 score of 8.6 (high). Red Hat’s advisory rates the issue as Important and recommends mitigation by limiting incoming message sizes and avoiding untrusted WebSocket peers. No official patch or fixed versions are explicitly stated in the advisory, and users are advised to monitor vendor updates.

A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted fragmented WebSocket messages that cause heap buffer overflow during message reassembly. This can lead to heap corruption, application crashes (denial of service), and potential exposure of memory contents such as cryptographic keys or sensitive information. The vulnerability impacts confidentiality, integrity, and availability, with the most severe impact being denial of service. There is no indication of known exploits in the wild at this time.

Red Hat advises setting conservative limits on the maximum total incoming WebSocket message size or payload where the API allows. Additionally, do not accept WebSocket connections from untrusted peers to mitigate the risk. No official patch or fix is currently confirmed; therefore, users should monitor vendor advisories for updates. Applying these mitigations reduces the risk until a fix is available.