Critical Heap Buffer Overflows in libsoup WebSocket Handling

• •CVE-2026-102559 and CVE-2026-102560 both involve heap buffer overflows in libsoup.
• •Exploitation requires sending large WebSocket messages, potentially influenced by attackers.
• •Mitigation includes enforcing message size limits and disabling unnecessary WebSocket features.

Two critical vulnerabilities were identified in libsoup affecting WebSocket handling. CVE-2026-102559 involves a heap buffer overflow when constructing masked WebSocket frames for large outgoing payloads, while CVE-2026-102560 occurs during the compression of large messages with the permessage-deflate extension. Both vulnerabilities are rated Important and could lead to heap corruption or denial of service. Exploitation requires the ability to send large messages, potentially influenced by attacker-controlled input. Affected systems include applications using libsoup for WebSocket connections. Mitigation strategies include enforcing message size limits and disabling unnecessary WebSocket extensions. Both CVEs were published on 2026-09-29.