Red Hat Security Advisory: libsoup3 security update

Libsoup3, a C-based HTTP library designed for asynchronous network communication in GNOME applications, contains several heap buffer overflow vulnerabilities. These include issues triggered by uninitialized length in data-URI base64 decoding (CVE-2026-102555), type confusion in WebSocket Pong signals (CVE-2026-102556), message reassembly (CVE-2026-102557), receive-buffer growth (CVE-2026-102558), client-frame masking (CVE-2026-102559), and outgoing permessage-deflate buffer growth (CVE-2026-102560). Red Hat has released security updates for Red Hat Enterprise Linux 10 and associated platforms to fix these vulnerabilities.

Heap buffer overflow vulnerabilities can lead to memory corruption, potentially allowing attackers to cause application crashes or execute arbitrary code. The affected library is used in GNOME applications for HTTP communication, so exploitation could impact applications relying on libsoup3 for network interactions. Red Hat rates the security impact as Important.

Red Hat has released security updates for libsoup3 in Red Hat Enterprise Linux 10 and related products. Users should apply these official patches as detailed in Red Hat advisory RHSA-2026:83618 and the referenced update article (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated by the vendor.