The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.
CVSS Details
- CVSS 3.1 Base Score: 4.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade libsoup-debuginfoUpgrade libsoup-develUpgrade libsoup | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade libsoup3-docUpgrade libsoup-debugsourceUpgrade libsoup-develUpgrade libsoup3Upgrade libsoup-docUpgrade libsoup3-debugsourceUpgrade libsoup3-debuginfoUpgrade libsoup-debuginfoUpgrade libsoup3-develUpgrade libsoup | Sep 30, 2026 | Jul 14, 2026 |
| Redhat_linux | — | No solution exists | Sep 17, 2026 | Apr 27, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub