CVE-2026-0716
Medium · 4.8CVSS
4.8
EPSS
0.4%
Published
Jan 13, 2026
CISA due date
—
The record
A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or a crash. Applications using libsoup’s WebSocket support with this configuration may be impacted.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Micro 5.2 | libsoup | 0 | 2.68.4-150200.4.24.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libsoup | 0 | 3.4.4-150600.3.28.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libsoup | 0 | 3.4.4-150600.3.42.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libsoup2 | 0 | 2.74.3-150600.4.33.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libsoup2 | 0 | 2.74.3-150600.4.24.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | libsoup | 0 | 3.4.4-150600.3.28.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | libsoup2 | 0 | 2.74.3-150600.4.24.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | libsoup | 0 | 3.4.4-150600.3.28.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | libsoup2 | 0 | 2.74.3-150600.4.24.1 |
| openSUSE:Leap 15.6 | libsoup | 0 | 3.4.4-150600.3.28.1 |
| openSUSE:Leap 15.6 | libsoup | 0 | 3.4.4-150600.3.42.1 |
| openSUSE:Leap 15.6 | libsoup2 | 0 | 2.74.3-150600.4.33.1 |
| openSUSE:Leap 15.6 | libsoup2 | 0 | 2.74.3-150600.4.24.1 |
| openSUSE:Leap 16.0 | libsoup | 0 | 3.6.5-160000.3.1 |
| openSUSE:Leap 16.0 | libsoup2 | 0 | 2.74.3-160000.4.1 |
| openSUSE:Tumbleweed | libsoup | 0 | 3.6.5-11.1 |
| openSUSE:Tumbleweed | libsoup2 | 0 | 2.74.3-15.1 |
Related vulnerabilities
- CVE-2026-1761 A flaw was found in libsoup. Also affects libsoup
- CVE-2026-1760 A flaw was found in SoupServer. Also affects libsoup
- CVE-2026-1539 A flaw was found in the libsoup HTTP library that can cause proxy authentication… Also affects libsoup
- CVE-2026-1467 A flaw was found in libsoup, an HTTP client library. Also affects libsoup
- CVE-2024-52531 GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform… Also affects libsoup
- CVE-2024-52532 GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. Also affects libsoup
- CVE-2024-52530 GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because… Also affects libsoup
- CVE-2026-2708 A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. Also affects libsoup