CVE-2026-102559 — Vulnerability intelligence

gnome — libsoup

Published: 2026-09-29T17:15:34.470Z

CVSS

8.6

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.

Sources

• CVE-2026-102559
• Third Party Advisory
• Third Party Advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Mitigation, Third Party Advisory
• Issue Tracking, Patch, Third Party Advisory
• CVE-2026-102559
• Original advisory
• Original advisory