A vulnerability exists in libsoup's SoupWebsocketConnection where setting max-incoming-payload-size to unlimited (0) allows an attacker-controlled frame length to cause the incoming GByteArray buffer to grow until its length wraps, resulting in a heap buffer overflow during frame data reading. This can lead to heap corruption or denial of service. Default configurations with finite payload size limits reduce exposure, but applications disabling this limit remain vulnerable. The issue is rated Important by Red Hat and affects Red Hat Enterprise Linux 10. The vulnerability is tracked as CVE-2026-102558 with a CVSS v3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).

An attacker can remotely trigger a heap buffer overflow by sending crafted WebSocket frames when the max-incoming-payload-size is unlimited, causing heap corruption or denial of service (application crash or restart). Confidentiality impact is low but may allow reading of memory contents that could aid further attacks. Integrity impact is low. Availability impact is high due to potential crashes. The vulnerability requires no privileges or user interaction and can be exploited over the network.

Red Hat advises configuring a finite max-incoming-payload-size on SoupWebsocketConnection to avoid unlimited buffer growth. Do not set this value to 0 (unlimited). Additionally, restrict WebSocket exposure to trusted peers only. No official patch status is explicitly stated in the advisory; therefore, patch status is not yet confirmed — check the Red Hat advisory for updates. These mitigations reduce exposure effectively.