Red Hat Patches Four WebSocket Heap Overflow Flaws in libsoup for RHEL 8.4
Red Hat has published security advisory RHSA-2026:92347, rated Important, covering four heap buffer overflow vulnerabilities in libsoup, the HTTP client and server library used by GNOME and by a wide range of Linux desktop and server applications. The four issues are tracked as CVE-2026-102556, CVE-2026-102557, CVE-2026-102558 and CVE-2026-102559, and all four sit in libsoup's WebSocket handling code. The advisory was issued on 29 October 2026 and applies to Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, on x86_64. Fixed packages are available as libsoup-2.62.3-2.el8_4.14, covering the base library, the devel package and the matching i686 multilib builds. Only customers running these extended-lifecycle 8.4 streams are in scope for this particular errata.
Red Hat has not published exploitation details or proof-of-concept material in the advisory, so the mechanism is known only from the flaw descriptions and the associated Bugzilla entries. CVE-2026-102556 is described as a heap buffer overflow arising from type confusion in the WebSocket Pong signal path, while CVE-2026-102557 occurs during WebSocket message reassembly, the stage where fragmented frames are stitched back into a single message. CVE-2026-102558 involves the growth of the WebSocket receive buffer, and CVE-2026-102559 affects client-frame masking, the routine a WebSocket client uses to obscure outbound payload bytes. All four are memory-corruption conditions in code that processes data supplied by the remote side of a WebSocket conversation. The advisory does not assign CVSS base scores inline, directing readers instead to the individual CVE pages for scoring and acknowledgements.
The practical exposure depends on which applications on a host actually link libsoup and speak WebSocket. Any GNOME component, desktop utility or server-side service that opens a WebSocket connection to an untrusted endpoint, or accepts one, is processing attacker-influenceable frames inside the vulnerable parsing paths, and heap corruption in a shared library of this kind can translate into crashes or code execution in the context of the calling process. The risk is concentrated on Red Hat Enterprise Linux 8.4 AUS and Extended Life Cycle Long Life hosts, which are typically long-lived production systems where the vulnerable libsoup build stays resident in running processes until those processes are restarted. FIRST EPSS currently puts the probability of exploitation in the next thirty days at 0.3 percent for CVE-2026-102556 and CVE-2026-102557, and 0.4 percent for CVE-2026-102558 and CVE-2026-102559, and none of the four appears in the CISA Known Exploited Vulnerabilities catalogue at this time. Red Hat's Important impact rating therefore reflects the memory-corruption potential of the flaws rather than any observed attack activity.
Attack Surface
Endpoint OS, Server OS
Tactics
Initial Access, Execution, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1203 – Exploitation for Client Execution
- T1499 – Endpoint Denial of Service
SuperPRO's Threat Countermeasures Procedures
- Install libsoup-2.62.3-2.el8_4.14 or later on all Red Hat Enterprise Linux 8.4 AUS and 8.4 Extended Life Cycle Long Life x86_64 hosts (dnf update libsoup), which is the build Red Hat ships in RHSA-2026:92347 for CVE-2026-102556, CVE-2026-102557, CVE-2026-102558 and CVE-2026-102559.
- On multilib systems, update both the x86_64 and i686 copies of the library, plus libsoup-devel where development packages are installed, since the errata ships libsoup-2.62.3-2.el8_4.14.i686.rpm and libsoup-2.62.3-2.el8_4.14.x86_64.rpm separately and a stale i686 copy leaves 32-bit consumers vulnerable.
- Build an exposure list with 'rpm -q libsoup libsoup-devel' across the estate, or use the Red Hat Lightspeed patch analysis linked in RHSA-2026:92347 to enumerate systems flagged against this advisory before the change window.
- After updating, identify processes still mapping the old library with 'lsof | grep libsoup-2.62' or 'needs-restarting -r' and restart the affected services and GNOME user sessions, because a running process keeps the vulnerable code resident until it is restarted.
- Verify package authenticity against the SHA-256 values published in the errata, for example cef254e564d01ec6294185b594f3de67a0821f89f87fc7ec5a02d4660ad949eb for libsoup-2.62.3-2.el8_4.14.src.rpm, when packages are staged through an internal mirror or Satellite rather than pulled directly from Red Hat.
- Confirm that the affected hosts are attached to the correct AUS or ELS Long Life repositories, since RHEL 8.4 content is only delivered to subscriptions carrying those add-ons and systems without them will silently not receive libsoup-2.62.3-2.el8_4.14.
- Until the update is deployed, restrict which applications on these hosts may open WebSocket connections to untrusted external endpoints by egress-filtering outbound TCP/80 and TCP/443 from GNOME and libsoup-linked services to an approved destination list, as all four flaws are triggered through WebSocket frame handling.
