CVE-2026-102560
Red Hat Enterprise Linux 10: Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth
Red Hat Red Hat Enterprise Linux 10Operating systems
CVSS
8.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.42%Chance of exploitation activity in the next 30 days, higher than 35% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
Text from CVE List
Affected versions 2
- Red Hat Enterprise Linux 10unaffected: 0:3.6.5-3.el10_2.20 and laterCVE List
- Red Hat Enterprise Linux 9unaffected: 0:2.72.0-16.el9_8.8 and laterCVE List