Threats tagged 'ghsa-cj4p-f4hv-cp74'

A heap buffer overflow vulnerability (CVE-2026-102559) exists in libsoup2.4 when constructing masked WebSocket client frames for very large outgoing payloads. The issue arises from truncation of size values passed to GByteArray allocation APIs while the masking routine uses the full length, leading to heap corruption or denial of service. Exploitation requires sending an extremely large WebSocket message, which depends on whether the application permits attacker-controlled message sizes. Red Hat has released security updates addressing this and related heap overflow issues in libsoup for Red Hat Enterprise Linux 9.