kritisch
CVE-2026-102560
libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (hoch), AlmaLinux (hoch), Amazon (hoch), Azure Linux (hoch), Oracle (hoch), Rocky Linux (hoch), Ubuntu (mittel).
Beschreibung
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alma 10 | libsoup3, libsoup3-devel, libsoup3-doc | 3.6.5-3.el10_2.20 |
| alma 9 | libsoup, libsoup-devel | 2.72.0-16.el9_8.8 |
| amazon linux 2023 | libsoup, libsoup-debuginfo, libsoup-debugsource und 2 weitere | 2.72.0-6.amzn2023.0.16 |
| Azure Linux 3.0 | libsoup | 0:3.4.4-17.azl3 |
| debian 11 | libsoup2.4 | kein Fix angegeben |
| debian 12 | libsoup2.4, libsoup3 | kein Fix angegeben |
| debian 13 | libsoup2.4, libsoup3 | kein Fix angegeben |
| debian 14 | libsoup3 | 3.8.0-1 |
| echo | libsoup2.4, libsoup3 | 3.6.6-1+e8 |
| Oracle Linux 9 | libsoup, libsoup-devel | 2.72.0-16.el9_8.8 |
| rapidfort alma 10 | libsoup3, libsoup3-devel, libsoup3-doc | 3.6.5-3.el10_2.20 |
| rapidfort alma 9 | libsoup, libsoup-devel | 2.72.0-16.el9_8.8 |
Alle 63 Einträge aus 30 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alma 10 | libsoup3 | 3.6.5-3.el10_2.20 |
| alma 10 | libsoup3-devel | 3.6.5-3.el10_2.20 |
| alma 10 | libsoup3-doc | 3.6.5-3.el10_2.20 |
| alma 9 | libsoup | 2.72.0-16.el9_8.8 |
| alma 9 | libsoup-devel | 2.72.0-16.el9_8.8 |
| amazon linux 2023 | libsoup | 2.72.0-6.amzn2023.0.16 |
| amazon linux 2023 | libsoup-debuginfo | 2.72.0-6.amzn2023.0.16 |
| amazon linux 2023 | libsoup-debugsource | 2.72.0-6.amzn2023.0.16 |
| amazon linux 2023 | libsoup-devel | 2.72.0-6.amzn2023.0.16 |
| amazon linux 2023 | libsoup-doc | 2.72.0-6.amzn2023.0.16 |
| Azure Linux 3.0 | libsoup | 0:3.4.4-17.azl3 |
| debian 11 | libsoup2.4 | kein Fix angegeben |
| debian 12 | libsoup2.4 | kein Fix angegeben |
| debian 12 | libsoup3 | kein Fix angegeben |
| debian 13 | libsoup2.4 | kein Fix angegeben |
| debian 13 | libsoup3 | kein Fix angegeben |
| debian 14 | libsoup3 | 3.8.0-1 |
| echo | libsoup2.4 | kein Fix angegeben |
| echo | libsoup3 | 3.6.6-1+e8 |
| Oracle Linux 9 | libsoup | 2.72.0-16.el9_8.8 |
| Oracle Linux 9 | libsoup-devel | 2.72.0-16.el9_8.8 |
| rapidfort alma 10 | libsoup3 | 3.6.5-3.el10_2.20 |
| rapidfort alma 10 | libsoup3-devel | 3.6.5-3.el10_2.20 |
| rapidfort alma 10 | libsoup3-doc | 3.6.5-3.el10_2.20 |
| rapidfort alma 9 | libsoup | 2.72.0-16.el9_8.8 |
| rapidfort alma 9 | libsoup-devel | 2.72.0-16.el9_8.8 |
| rapidfort amazon linux 2023 | libsoup | 2.72.0-6.amzn2023.0.16 |
| rapidfort amazon linux 2023 | libsoup-devel | 2.72.0-6.amzn2023.0.16 |
| rapidfort amazon linux 2023 | libsoup-doc | 2.72.0-6.amzn2023.0.16 |
| rapidfort amazon linux 2023 | libsoup3 | 3.6.5-47.amzn2023 |
| rapidfort debian | rf-libsoup3 | 0:3.8.0-1 |
| rapidfort debian 12 | libsoup2.4 | kein Fix angegeben |
| rapidfort debian 12 | libsoup3 | 0:3.8.0-1 |
| rapidfort debian 12 | rf-libsoup3 | 0:3.8.0-1 |
| rapidfort debian 13 | libsoup2.4 | kein Fix angegeben |
| rapidfort debian 13 | libsoup3 | 0:3.8.0-1 |
| rapidfort debian 13 | rf-libsoup3 | 0:3.8.0-1 |
| rapidfort Oracle Linux 10 | libsoup3 | 0:3.6.5-3.el10_2.20 |
| rapidfort Oracle Linux 10 | libsoup3-devel | 0:3.6.5-3.el10_2.20 |
| rapidfort Oracle Linux 9 | libsoup | 0:2.72.0-16.el9_8.8 |
| rapidfort Oracle Linux 9 | libsoup-devel | 0:2.72.0-16.el9_8.8 |
| rapidfort rocky 9 | libsoup | 0:2.72.0-16.el9_8.8 |
| rapidfort rocky 9 | libsoup-devel | 0:2.72.0-16.el9_8.8 |
| rapidfort ubuntu | libsoup3 | kein Fix angegeben |
| rapidfort ubuntu | rf-libsoup3 | kein Fix angegeben |
| rapidfort ubuntu 20.04 | libsoup3 | kein Fix angegeben |
| rapidfort ubuntu 20.04 | rf-libsoup3 | kein Fix angegeben |
| rapidfort ubuntu 22.04 | libsoup3 | kein Fix angegeben |
| rapidfort ubuntu 22.04 | rf-libsoup3 | kein Fix angegeben |
| rapidfort ubuntu 24.04 | libsoup3 | kein Fix angegeben |
| rapidfort ubuntu 24.04 | rf-libsoup3 | kein Fix angegeben |
| Red Hat | libsoup | kein Fix angegeben |
| Red Hat | libsoup-devel | kein Fix angegeben |
| rocky 9 | libsoup | 2.72.0-16.el9_8.8 |
| rocky 9 | libsoup-devel | 2.72.0-16.el9_8.8 |
| ubuntu 20.04-ESM | libsoup2.4 | kein Fix angegeben |
| ubuntu 22.04 | libsoup2.4 | kein Fix angegeben |
| ubuntu 22.04 | libsoup3 | kein Fix angegeben |
| ubuntu 24.04 | libsoup2.4 | kein Fix angegeben |
| ubuntu 24.04 | libsoup3 | kein Fix angegeben |
| ubuntu 26.04 | libsoup2.4 | kein Fix angegeben |
| ubuntu 26.04 | libsoup3 | kein Fix angegeben |
| ubuntu 26.10 | libsoup3 | kein Fix angegeben |
Referenzen
- https://access.redhat.com/errata/RHSA-2026:83384
- https://access.redhat.com/errata/RHSA-2026:83618
- https://access.redhat.com/security/cve/CVE-2026-102560
- https://bugzilla.redhat.com/2543229
- https://bugzilla.redhat.com/2543231
- https://bugzilla.redhat.com/2543274
- https://bugzilla.redhat.com/2543285
- https://bugzilla.redhat.com/2543296
Alle 26 Referenzen
- https://bugzilla.redhat.com/show_bug.cgi?id=2543229
- https://bugzilla.redhat.com/show_bug.cgi?id=2543231
- https://bugzilla.redhat.com/show_bug.cgi?id=2543274
- https://bugzilla.redhat.com/show_bug.cgi?id=2543285
- https://bugzilla.redhat.com/show_bug.cgi?id=2543296
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102556
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102557
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102558
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102559
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102560
- https://errata.almalinux.org/9/ALSA-2026-83384.html
- https://errata.rockylinux.org/RLSA-2026:83384
- https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
- https://linux.oracle.com/cve/CVE-2026-102560.html
- https://linux.oracle.com/errata/ELSA-2026-83618.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-102560
- https://www.cve.org/CVERecord?id=CVE-2026-102560