CVE-2026-102559 is a heap buffer overflow vulnerability in libsoup used by Red Hat Enterprise Linux 10. The issue arises when constructing a masked WebSocket client frame for a very large outgoing payload. Size values passed to GByteArray allocation APIs may be truncated, but the masking routine still uses the full length, causing a heap buffer overflow. This can result in heap corruption or denial of service in the sending process. The vulnerability requires an attacker to cause the WebSocket client to send an extremely large message, which may be possible if application-level message sizes are attacker-influenced. Red Hat's advisory emphasizes mitigation by enforcing application-level limits on outgoing WebSocket message sizes and avoiding sending untrusted bulk data as a single WebSocket message.

The vulnerability can cause heap corruption or denial of service (process crash or restart) in the sending process of the WebSocket client. Confidentiality impact is low, with potential for out-of-bounds reads that might leak memory contents. Integrity impact is low, but availability impact is high due to possible crashes. There are no known exploits in the wild. Exploitation requires sending an extremely large WebSocket message, which may be attacker-controlled at the application level.

Red Hat advises enforcing application-level limits on outgoing WebSocket message sizes to mitigate this issue. Avoid sending untrusted bulk data as a single WebSocket message. No official patch status is provided in the advisory; therefore, patch status is not yet confirmed—check the Red Hat advisory for updates. No generic or unrelated mitigations are recommended.