Vulnerability · Published Jul 14, 2026 · Assigned by redhat
CVE-2026-12478Libsoup: incomplete fix for cve-2026-0716: out-of-bounds read in libsoup websocket frame processing (unmasked path)
Medium 4.8
In plain English
A medium-severity out-of-bounds read in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | libsoup3 | 3.8.0-1 | DEBIAN-CVE-2026-12478 |
| Ubuntu:22.04:LTS | libsoup2.4 | 2.74.2-3ubuntu0.10 | USN-8975-1 |
| Ubuntu:24.04:LTS | libsoup2.4 | 2.74.3-6ubuntu1.10 | USN-8975-1 |
| Ubuntu:24.04:LTS | libsoup3 | 3.4.4-5ubuntu0.10 | UBUNTU-CVE-2026-12478 |
| Ubuntu:24.04:LTS | libsoup3 | 3.4.4-5ubuntu0.10 | USN-8975-1 |
| Ubuntu:26.04:LTS | libsoup3 | 3.6.6-1ubuntu0.2 | UBUNTU-CVE-2026-12478 |
| Ubuntu:26.04:LTS | libsoup3 | 3.6.6-1ubuntu0.2 | USN-8975-1 |
| Ubuntu:26.10 | libsoup3 | 3.6.6-1ubuntu3.1 | UBUNTU-CVE-2026-12478 |
| Ubuntu:26.10 | libsoup3 | 3.6.6-1ubuntu3.1 | USN-8975-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
References
- https://access.redhat.com/security/cve/CVE-2026-12478 vdb-entry, x_refsource_REDHAT
- RHBZ#2489655 issue-tracking, x_refsource_REDHAT
- https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/518