CVE-2026-102556
Gnome Libsoup: denial of service
- Risk score
- 60/100
- CVSS
- 8.6 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash u…
- Affected
- Gnome Libsoup
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Gnome Libsoup: Amber, patch this week. A Use-After-Free vulnerability in libsoup's HTTP/2 server implementation allows a remote attacker to cause application instability or crashes, resulting in a Denial of Service (DoS), by sending specially crafted HTTP/2 requests.
The flaws
- CVE-2026-102556: Denial of service (CVSS 8.6 · EPSS 0%)
- CVE-2026-4271: Use-after-free can lead to denial of service (CVSS 7.5 · EPSS 1%)
- CVE-2026-102560: Out-of-bounds read (CVSS 9.8 · EPSS 0%)
- CVE-2026-5119: A flaw was found in libsoup (CVSS 8.2 · EPSS 0%)
The fix
Fix: Check the linked advisory for details on the fix.
Who is exposed: {'products': ['libsoup'], 'packages': [], 'versions': []}
Where it stands
- Public proof of concept
How it unfolded
- 21 Oct, Ubuntu security notices (official): USN-8890-2: libsoup vulnerabilities
Connects to
- Same weakness: CWE-843 (CWE-843). 61 other warnings in 30 days
- Same product: Earlier Gnome Libsoup warnings. 5 in the last 90 days
Why it is Amber
- CVSS 8.6 high
- Remotely exploitable without logging in
References
Original description
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.
Last activity 29 Sep 2026. Patch Forecast updates every hour.