External risk intelligence

libsoup Heap Buffer Overflow via WebSocket Compression

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-102560

libsoup is a HTTP client/server library commonly used in desktop applications and local services. While it facilitates network communication and WebSocket handling, which are reachable, it is typically embedded within larger software applications rather than functioning as a standalone internet-facing edge service or gateway, making direct public internet exposure less common than dedicated network appliances.

Out-of-bounds Read

Gnome Libsoup

before 3.7.37.08.09.010.0

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A recently identified issue in the libsoup technology could allow an attacker to remotely exploit a memory corruption flaw during the compression of large messages. This could potentially lead to a compromise of the affected systems. The main concern is confirming relevance and exposure.

Memory flaw in message compression.
Matters for systems using this technology.
Confirm relevance and system exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by sending a specially crafted, very large WebSocket message. If the libsoup library attempts to compress this message using the per-message-deflate extension, a calculation error could lead to a heap buffer overflow. This overflow occurs when the library tries to allocate memory for compressed data, potentially allowing an attacker to corrupt memory and cause the application to crash or behave unexpectedly.

Network access to a vulnerable service is required.
Triggered by sending a large WebSocket message.
Risk of memory corruption and application instability.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to cause a denial of service when processing a very large outgoing WebSocket message, potentially leading to application instability. The flaw involves a heap buffer overflow due to incorrect size calculations during compression.

Application stability.
Networked message processing.
Service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given the vulnerability in libsoup, application owners and platform teams are likely responsible for addressing this issue, as it affects a core library for network communication. The first practical step is to identify all instances of libsoup within your environment, determine their reachability and criticality, and then locate the accountable owners before planning remediation.

Application and platform teams own the issue.
Verify affected application and service deployments.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is libsoup?

libsoup is a library designed for HTTP client and server communication. Developers frequently embed it into desktop applications and local services to handle network requests and WebSocket connections, enabling those programs to communicate across a network.

How does CVE-2026-102560 cause a heap buffer overflow?

This vulnerability, classified as an out-of-bounds read or write (CWE-125), occurs during WebSocket compression. When libsoup processes a very large message, a calculation error causes the system to allocate insufficient memory. This leads the zlib compression tool to write data past the intended buffer, corrupting the heap memory.

Do I need to send a specific type of message to trigger this bug?

Yes, an attacker must send a specially crafted, very large WebSocket message that utilizes the per-message-deflate extension. The vulnerability is not triggered by standard, small messages or by WebSocket traffic that does not attempt to use this specific compression extension.

Is my system at risk if I use libsoup?

According to Halo Surface Signal, libsoup is usually embedded in larger applications rather than serving as a standalone internet-facing gateway. While network reachability is required to trigger the flaw, your risk depends on whether your specific applications use libsoup to process WebSocket traffic from untrusted sources.

When should I take action to address this CVE?

You should begin by performing an inventory to locate all instances of libsoup within your environment. Once identified, evaluate which applications or services utilize WebSocket compression and prioritize those that are reachable over the network for updates or vendor-supplied patches.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.