ELSA-2026-83384

ELSA-2026-83384 - libsoup security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-15

Description

[2.72.0-16.8]
- CVE-2026-102556 libsoup: libsoup: Heap buffer overflow from WebSocket
Pong signal type confusion

[2.72.0-16.7]
- CVE-2026-102558 libsoup: libsoup: Heap buffer overflow during WebSocket
receive-buffer growth

[2.72.0-16.6]
- CVE-2026-102559 libsoup: libsoup: Heap buffer overflow during WebSocket
client-frame masking

[2.72.0-16.5]
- CVE-2026-102560 libsoup: libsoup: Heap buffer overflow during outgoing
permessage-deflate buffer growth

[2.72.0-16.4]
- CVE-2026-102557 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly
message reassembly

Related CVEs

CVE-2026-102556

CVE-2026-102557

CVE-2026-102558

CVE-2026-102559

CVE-2026-102560

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	libsoup-2.72.0-16.el9_8.8.src.rpm	67b934d25b934a45a843168ce895cb370c7486aef924474b2dcbe93951a684c0	-	ol9_aarch64_appstream
	libsoup-2.72.0-16.el9_8.8.aarch64.rpm	a1e6eb4c939abeb368ee861f08f0e98ac76c249b712fc51e12c7df0771ce1f1c	-	ol9_aarch64_appstream
	libsoup-devel-2.72.0-16.el9_8.8.aarch64.rpm	ad00c03599a05d3ab1d9d463e4086320a15ff10c36b15ca8be464111fd570b6e	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	libsoup-2.72.0-16.el9_8.8.src.rpm	67b934d25b934a45a843168ce895cb370c7486aef924474b2dcbe93951a684c0	-	ol9_x86_64_appstream
	libsoup-2.72.0-16.el9_8.8.i686.rpm	00f7a11a4eb52827cd1cc6d97ee7d52159b0831910d29d3b61b05e859b0ce02f	-	ol9_x86_64_appstream
	libsoup-2.72.0-16.el9_8.8.x86_64.rpm	a9ee1380d1ee676ce0be1ce26d42cfe78db00784802bcc93efcd1760afa2be55	-	ol9_x86_64_appstream
	libsoup-devel-2.72.0-16.el9_8.8.i686.rpm	88f99690868f1fe46721cca72e5b0833ea813a0c40cca4cb584f51f643d1ff17	-	ol9_x86_64_appstream
	libsoup-devel-2.72.0-16.el9_8.8.x86_64.rpm	bca085a94976214cb5b19f5fc9a2b65b35c0c8129bcc5da36aeaaa1de3e0173a	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team