Executive brief
libsoup, a widely used HTTP client/server library for GNOME and Linux applications, contains a flaw in how it handles WebSocket communications. An attacker can send a specially crafted message that violates standard networking rules, causing the application using libsoup to crash or immediately terminate the connection. This results in a denial of service, potentially disrupting web services or applications that rely on real-time WebSocket data.
Technical details
A vulnerability exists in libsoup's WebSocket frame parsing implementation within `soup-websocket-connection.c`. Per RFC 6455 §5.5, control frames (PING, PONG, CLOSE) must not exceed a payload of 125 bytes. While libsoup's send path correctly enforces this limit, the receive path (`process_frame()`) fails to validate incoming control frame lengths. When an oversized PING is received, the library attempts to echo it back; the send path then detects the violation and triggers `protocol_error_and_close()` on itself. This allows a remote, unauthenticated attacker to cause a connection crash or application-level denial of service with a single non-compliant frame.
Affected products
- Red Hat libsoup3 Red Hat Enterprise Linux 10
- Red Hat libsoup Red Hat Enterprise Linux 8, 9
- GNOME libsoup 3.4.4, likely all versions with WebSocket support
Timeline
- 2026-07-14: disclosed: Publicly reported via GNOME GitLab and Red Hat Bugzilla
- 2026-07-14: advisory: NVD published the CVE record