This vulnerability in libsoup arises from incorrect truncated size calculations during buffer growth when compressing large outgoing WebSocket messages with the permessage-deflate extension. The wraparound in size calculations causes zlib to write beyond the allocated buffer, resulting in a heap buffer overflow. The flaw can cause heap corruption or application crashes (denial of service). Exploitation requires the permessage-deflate extension to be negotiated and large outgoing messages to be compressed. The vulnerability is rated important by Red Hat with a CVSS 3.1 score of 8.6 (high severity).

Successful exploitation can cause heap corruption leading to potential information disclosure, bypass of protection mechanisms such as ASLR, and denial of service through application crashes. Confidentiality and integrity impacts are low, but availability impact is high due to possible crashes. Exploitation requires network access with no privileges or user interaction needed.

Red Hat recommends disabling the permessage-deflate WebSocket extension if it is not required and capping outgoing message sizes to mitigate this vulnerability. There is no explicit mention of an official patch available yet; therefore, check the Red Hat advisory for updates on fixes. Until a fix is released, applying these mitigations is advised.