The vulnerability in libsoup arises from inadequate capping of the total size of reassembled fragmented WebSocket messages into a GByteArray. When a remote peer sends fragments that cause size truncation, the implementation still uses the full length, leading to heap corruption or a crash. This can be triggered remotely without authentication. The issue affects any Red Hat product or application exposing or consuming libsoup WebSockets with untrusted peers. The CVSS v3.1 score is 8.6 (high), reflecting network attack vector, low complexity, no privileges or user interaction required, with low confidentiality and integrity impact but high availability impact. The vendor advisory recommends setting conservative maximum incoming message size limits where possible and avoiding WebSocket connections from untrusted peers. No explicit patch or fixed version is stated in the advisory, so patch status is not yet confirmed.

A remote unauthenticated attacker can cause heap corruption or denial of service (application crash) by sending specially crafted fragmented WebSocket messages. There is also potential for out-of-bounds reads that could leak memory contents, possibly aiding further attacks such as bypassing protection mechanisms. The availability impact is high due to possible crashes, while confidentiality and integrity impacts are low.

Red Hat advises setting conservative maximum total incoming message size or incoming payload limits where the API allows. Additionally, do not accept WebSocket connections from untrusted peers. The advisory does not confirm an official patch or fix at this time. Patch status is not yet confirmed—check the Red Hat advisory for updates. These mitigations reduce the risk until an official fix is available.