CVE-2026-102560 in Red Hat
Summary
by MITRE • 09/29/2026
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified within the libsoup library represents a critical memory safety issue rooted in improper handling of data compression operations during WebSocket communications. Specifically, this flaw affects the permessage-deflate extension, which is designed to compress outgoing messages to optimize bandwidth usage and reduce latency in network transmissions. When processing exceptionally large payloads that require compression, the internal logic responsible for managing buffer growth utilizes truncated size calculations when expanding a GByteArray structure. This arithmetic error leads to an integer overflow condition where the calculated required memory size wraps around due to exceeding the maximum value representable by the data type used for tracking allocation sizes. Consequently, the system allocates a significantly smaller buffer than actually needed to hold the compressed output generated by zlib.
This miscalculation directly results in a heap-based buffer overflow when the zlib compression library attempts to write the full decompressed or intermediate result into the undersized allocated memory region. Because the boundary checks are bypassed due to the wrapped size value, data is written beyond the end of the allocated heap segment. Such an overwrite can corrupt adjacent heap metadata, leading to potential application crashes through denial of service conditions if the corruption triggers a segmentation fault during subsequent memory operations or deallocation routines. More critically, in scenarios where attacker-controlled input influences the content being compressed, this overflow may allow for arbitrary code execution by overwriting function pointers or other control data structures within the heap space, thereby compromising the integrity and confidentiality of the host system running the affected software.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound as the root cause, which subsequently leads to CWE-787 Out-of-bounds Write due to insufficient buffer size validation prior to memory access operations. The exploitation vector typically involves sending crafted WebSocket frames that trigger the compression pathway with large payloads, placing this vulnerability within the context of ATT&CK technique T1059 Command and Scripting Interpreter if used for initial execution or potentially T1203 Exploitation for Client Execution depending on how the compromised application is utilized. The impact extends beyond simple data corruption as it undermines the fundamental memory safety guarantees expected in modern network libraries, posing severe risks to services relying on libsoup for secure web communication protocols.
Mitigation strategies must prioritize immediate patching of the affected library version to address the integer calculation logic and enforce strict bounds checking before any heap allocation occurs based on compressed output sizes. Developers should implement defensive programming practices that validate input payload sizes against known compression ratio limits or apply explicit checks to ensure that calculated buffer requirements do not exceed safe thresholds prior to invocation of external compression libraries like zlib. Additionally, enabling compiler-based security features such as stack canaries and full RELRO where applicable provides an additional layer of defense-in-depth by making exploitation more difficult even if the underlying memory corruption occurs. Regular auditing of third-party dependencies for similar patterns in size calculation logic is also recommended to prevent recurrence of analogous vulnerabilities across different components of the software supply chain.