This vulnerability arises from libsoup emitting the ::pong signal with a GByteArray pointer while the signal is declared to pass a GBytes object. Applications that connect handlers following the documented GBytes API may trigger heap corruption or a crash upon receiving a maliciously crafted WebSocket Pong frame. The flaw affects WebSocket support used by client and server applications on Red Hat platforms. Exploitation requires no privileges or user interaction and can cause denial of service through process crashes or heap corruption.

A remote attacker can send a specially crafted WebSocket Pong frame that triggers heap corruption or crashes the affected application process. This can lead to denial of service. The vulnerability impacts confidentiality and integrity at a low level but has a high impact on availability due to potential crashes. No known exploits are reported in the wild at this time.

Red Hat advises avoiding connecting custom handlers to the SoupWebsocketConnection::pong signal or avoiding WebSocket use with untrusted peers. No official patch status is provided in the advisory; therefore, patch status is not yet confirmed—check the vendor advisory for current remediation guidance.