crítica
CVE-2026-102560
libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (alta), AlmaLinux (alta), Amazon (alta), Azure Linux (alta), Oracle (alta), Rocky Linux (alta), Ubuntu (media).
Descripción
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 10 | libsoup3, libsoup3-devel, libsoup3-doc | 3.6.5-3.el10_2.20 |
| alma 9 | libsoup, libsoup-devel | 2.72.0-16.el9_8.8 |
| amazon linux 2023 | libsoup, libsoup-debuginfo, libsoup-debugsource y 2 más | 2.72.0-6.amzn2023.0.16 |
| Azure Linux 3.0 | libsoup | 0:3.4.4-17.azl3 |
| debian 11 | libsoup2.4 | sin corrección indicada |
| debian 12 | libsoup2.4, libsoup3 | sin corrección indicada |
| debian 13 | libsoup2.4, libsoup3 | sin corrección indicada |
| debian 14 | libsoup3 | 3.8.0-1 |
| echo | libsoup2.4, libsoup3 | 3.6.6-1+e8 |
| Oracle Linux 9 | libsoup, libsoup-devel | 2.72.0-16.el9_8.8 |
| rapidfort alma 10 | libsoup3, libsoup3-devel, libsoup3-doc | 3.6.5-3.el10_2.20 |
| rapidfort alma 9 | libsoup, libsoup-devel | 2.72.0-16.el9_8.8 |
Mostrar las 63 entradas de 30 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 10 | libsoup3 | 3.6.5-3.el10_2.20 |
| alma 10 | libsoup3-devel | 3.6.5-3.el10_2.20 |
| alma 10 | libsoup3-doc | 3.6.5-3.el10_2.20 |
| alma 9 | libsoup | 2.72.0-16.el9_8.8 |
| alma 9 | libsoup-devel | 2.72.0-16.el9_8.8 |
| amazon linux 2023 | libsoup | 2.72.0-6.amzn2023.0.16 |
| amazon linux 2023 | libsoup-debuginfo | 2.72.0-6.amzn2023.0.16 |
| amazon linux 2023 | libsoup-debugsource | 2.72.0-6.amzn2023.0.16 |
| amazon linux 2023 | libsoup-devel | 2.72.0-6.amzn2023.0.16 |
| amazon linux 2023 | libsoup-doc | 2.72.0-6.amzn2023.0.16 |
| Azure Linux 3.0 | libsoup | 0:3.4.4-17.azl3 |
| debian 11 | libsoup2.4 | sin corrección indicada |
| debian 12 | libsoup2.4 | sin corrección indicada |
| debian 12 | libsoup3 | sin corrección indicada |
| debian 13 | libsoup2.4 | sin corrección indicada |
| debian 13 | libsoup3 | sin corrección indicada |
| debian 14 | libsoup3 | 3.8.0-1 |
| echo | libsoup2.4 | sin corrección indicada |
| echo | libsoup3 | 3.6.6-1+e8 |
| Oracle Linux 9 | libsoup | 2.72.0-16.el9_8.8 |
| Oracle Linux 9 | libsoup-devel | 2.72.0-16.el9_8.8 |
| rapidfort alma 10 | libsoup3 | 3.6.5-3.el10_2.20 |
| rapidfort alma 10 | libsoup3-devel | 3.6.5-3.el10_2.20 |
| rapidfort alma 10 | libsoup3-doc | 3.6.5-3.el10_2.20 |
| rapidfort alma 9 | libsoup | 2.72.0-16.el9_8.8 |
| rapidfort alma 9 | libsoup-devel | 2.72.0-16.el9_8.8 |
| rapidfort amazon linux 2023 | libsoup | 2.72.0-6.amzn2023.0.16 |
| rapidfort amazon linux 2023 | libsoup-devel | 2.72.0-6.amzn2023.0.16 |
| rapidfort amazon linux 2023 | libsoup-doc | 2.72.0-6.amzn2023.0.16 |
| rapidfort amazon linux 2023 | libsoup3 | 3.6.5-47.amzn2023 |
| rapidfort debian | rf-libsoup3 | 0:3.8.0-1 |
| rapidfort debian 12 | libsoup2.4 | sin corrección indicada |
| rapidfort debian 12 | libsoup3 | 0:3.8.0-1 |
| rapidfort debian 12 | rf-libsoup3 | 0:3.8.0-1 |
| rapidfort debian 13 | libsoup2.4 | sin corrección indicada |
| rapidfort debian 13 | libsoup3 | 0:3.8.0-1 |
| rapidfort debian 13 | rf-libsoup3 | 0:3.8.0-1 |
| rapidfort Oracle Linux 10 | libsoup3 | 0:3.6.5-3.el10_2.20 |
| rapidfort Oracle Linux 10 | libsoup3-devel | 0:3.6.5-3.el10_2.20 |
| rapidfort Oracle Linux 9 | libsoup | 0:2.72.0-16.el9_8.8 |
| rapidfort Oracle Linux 9 | libsoup-devel | 0:2.72.0-16.el9_8.8 |
| rapidfort rocky 9 | libsoup | 0:2.72.0-16.el9_8.8 |
| rapidfort rocky 9 | libsoup-devel | 0:2.72.0-16.el9_8.8 |
| rapidfort ubuntu | libsoup3 | sin corrección indicada |
| rapidfort ubuntu | rf-libsoup3 | sin corrección indicada |
| rapidfort ubuntu 20.04 | libsoup3 | sin corrección indicada |
| rapidfort ubuntu 20.04 | rf-libsoup3 | sin corrección indicada |
| rapidfort ubuntu 22.04 | libsoup3 | sin corrección indicada |
| rapidfort ubuntu 22.04 | rf-libsoup3 | sin corrección indicada |
| rapidfort ubuntu 24.04 | libsoup3 | sin corrección indicada |
| rapidfort ubuntu 24.04 | rf-libsoup3 | sin corrección indicada |
| Red Hat | libsoup | sin corrección indicada |
| Red Hat | libsoup-devel | sin corrección indicada |
| rocky 9 | libsoup | 2.72.0-16.el9_8.8 |
| rocky 9 | libsoup-devel | 2.72.0-16.el9_8.8 |
| ubuntu 20.04-ESM | libsoup2.4 | sin corrección indicada |
| ubuntu 22.04 | libsoup2.4 | sin corrección indicada |
| ubuntu 22.04 | libsoup3 | sin corrección indicada |
| ubuntu 24.04 | libsoup2.4 | sin corrección indicada |
| ubuntu 24.04 | libsoup3 | sin corrección indicada |
| ubuntu 26.04 | libsoup2.4 | sin corrección indicada |
| ubuntu 26.04 | libsoup3 | sin corrección indicada |
| ubuntu 26.10 | libsoup3 | sin corrección indicada |
Referencias
- https://access.redhat.com/errata/RHSA-2026:83384
- https://access.redhat.com/errata/RHSA-2026:83618
- https://access.redhat.com/security/cve/CVE-2026-102560
- https://bugzilla.redhat.com/2543229
- https://bugzilla.redhat.com/2543231
- https://bugzilla.redhat.com/2543274
- https://bugzilla.redhat.com/2543285
- https://bugzilla.redhat.com/2543296
Las 26 referencias
- https://bugzilla.redhat.com/show_bug.cgi?id=2543229
- https://bugzilla.redhat.com/show_bug.cgi?id=2543231
- https://bugzilla.redhat.com/show_bug.cgi?id=2543274
- https://bugzilla.redhat.com/show_bug.cgi?id=2543285
- https://bugzilla.redhat.com/show_bug.cgi?id=2543296
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102556
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102557
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102558
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102559
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102560
- https://errata.almalinux.org/9/ALSA-2026-83384.html
- https://errata.rockylinux.org/RLSA-2026:83384
- https://gitlab.gnome.org/GNOME/libsoup/-/work_items/554
- https://linux.oracle.com/cve/CVE-2026-102560.html
- https://linux.oracle.com/errata/ELSA-2026-83618.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-102560
- https://www.cve.org/CVERecord?id=CVE-2026-102560