{"id":"CLSA-2026-1792600325","summary":"libsoup: Fix of 6 CVEs","details":"- CVE-2026-102555: decode base64 data: URI content with g_base64_decode_step()\n  over the real buffer length in soup_request_data_send(), so a percent-encoded\n  NUL no longer truncates the payload, leaks the decode buffer and raises a\n  GLib-CRITICAL\n- CVE-2026-102556: emit the WebSocket ::pong signal with a GBytes, as the signal\n  and the public header have always declared, instead of a GByteArray, removing\n  the type confusion a crafted Pong frame could turn into heap corruption in any\n  handler that honours the documented API\n- CVE-2026-102557: cap a reassembled WebSocket message at what a GByteArray can\n  hold before each fragment is appended in process_contents(), so a run of\n  fragments can no longer truncate the guint size passed to\n  g_byte_array_sized_new()/g_byte_array_append() while the full length is used\n- CVE-2026-102558: reject an incoming frame whose declared payload exceeds what\n  the receive buffer can represent as soon as the header is parsed, so the\n  incoming GByteArray can no longer grow until g_byte_array_set_size() wraps and\n  the read writes past the allocation\n- CVE-2026-102559: reject an outgoing payload above MAX_OUTGOING_PAYLOAD_SIZE in\n  send_message(), both before and after extensions have processed it, so a\n  masked client frame can no longer be built in a truncated GByteArray while\n  xor_with_mask() writes the full payload length past the allocation\n- CVE-2026-102560: refuse an outgoing permessage-deflate payload whose\n  deflateBound() exceeds G_MAXUINT and bound every incremental buffer growth, so\n  a truncated bound can no longer let zlib write past the allocated GByteArray","modified":"2026-10-26T09:31:36.615339652Z","published":"2026-10-22T01:36:08Z","upstream":["CVE-2026-102555","CVE-2026-102556","CVE-2026-102557","CVE-2026-102558","CVE-2026-102559","CVE-2026-102560"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792600325.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102555"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102556"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102557"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102558"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102559"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102560"}],"affected":[{"package":{"name":"libsoup","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/libsoup?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.0-10.el9_6.3.tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1792600325.json"}},{"package":{"name":"libsoup-devel","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/libsoup-devel?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.0-10.el9_6.3.tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1792600325.json"}},{"package":{"name":"libsoup-doc","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/libsoup-doc?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.0-10.el9_6.3.tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1792600325.json"}}],"schema_version":"1.9.0"}