CVE-2026-102559

{
  "etk_id": "ETK-2026-3",
  "cve_id": "CVE-2026-102559",
  "display_id": "CVE-2026-102559",
  "ghsa_id": "GHSA-cj4p-f4hv-cp74",
  "euvd_id": "EUVD-2026-89104",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Heap buffer overflow in libsoup WebSocket frame construction",
  "summary": "Red Hat Enterprise Linux 10 systems using the libsoup or libsoup3 packages may be affected when an application creates masked WebSocket client frames for very large outgoing payloads. An attacker who can cause such payload construction may trigger memory corruption; the relevant precondition is an affected application sending a sufficiently large masked WebSocket client frame.",
  "mitigation": "Limit or reject unusually large outgoing WebSocket payloads and disable unneeded WebSocket client functionality where feasible. Apply Red Hat updates for libsoup or libsoup3 when they become available.",
  "vendor": "Red Hat",
  "product": "Red Hat Enterprise Linux 10",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "libsoup3",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "libsoup",
      "purl": null
    }
  ],
  "cwes": [
    125
  ],
  "cvss_score": 8.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
  "epss_score": 0.004,
  "epss_percentile": 0.332,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 20.211504766666668,
  "t0_at": "2026-09-29T17:15:34.470000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-09-29T17:15:34.470000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-29T17:15:34.470000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102559"
    }
  }
}