ELSA-2026-83618

ELSA-2026-83618 - libsoup3 security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-15

Description

[3.6.5-20]
- CVE-2026-102557 libsoup3: libsoup: Heap buffer overflow during WebSocket
message reassembly

[3.6.5-19]
- CVE-2026-102556 libsoup3: libsoup: Heap buffer overflow from WebSocket
Pong signal type confusion

[3.6.5-18]
- CVE-2026-102558 libsoup3: libsoup: Heap buffer overflow during WebSocket
receive-buffer growth

[3.6.5-17]
- CVE-2026-102555 libsoup3: libsoup: Heap buffer overflow via uninitialized
length in data-URI base64 decoding

[3.6.5-16]
- CVE-2026-102560 libsoup3: libsoup: Heap buffer overflow during outgoing
permessage-deflate buffer growth

[3.6.5-15]
- CVE-2026-102559 libsoup3: libsoup: Heap buffer overflow during WebSocket
client-frame masking

[3.6.5-14]
- Fix CVE-2026-85197: http2 crash after connection destroyed

[3.6.5-13]
- Fix CVE-2026-15711: Reject oversized WebSocket control frames

[3.6.5-12]
- Fix CVE-2026-15709: bound decompressed WebSocket message size

[3.6.5-11]
- Add patches for CVE-2026-4271 and CVE-2026-5119

Related CVEs

CVE-2026-102555

CVE-2026-102556

CVE-2026-102557

CVE-2026-102558

CVE-2026-102559

CVE-2026-102560

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	libsoup3-3.6.5-3.el10_2.20.src.rpm	f14d81fdf643cdfc89b9b5c161ddada21f52d63a919faa9a8f8efeacaaf58b18	-	ol10_aarch64_appstream
	libsoup3-3.6.5-3.el10_2.20.src.rpm	f14d81fdf643cdfc89b9b5c161ddada21f52d63a919faa9a8f8efeacaaf58b18	-	ol10_aarch64_codeready_builder
	libsoup3-3.6.5-3.el10_2.20.aarch64.rpm	a6d076f686aa8642893f2a3812edc349668ee76395dd79ae09e5d2591d32f269	-	ol10_aarch64_appstream
	libsoup3-devel-3.6.5-3.el10_2.20.aarch64.rpm	c7e997aacca3485f4f8d9a63e39e9cafe94109f7349a58492aedbf6cda8fa925	-	ol10_aarch64_appstream
	libsoup3-doc-3.6.5-3.el10_2.20.noarch.rpm	e0821cf3c143ec7cd14bbf7c8716552378944c0ff98e4729c5bf899283e7a4fc	-	ol10_aarch64_codeready_builder
Oracle Linux 10 (x86_64)	libsoup3-3.6.5-3.el10_2.20.src.rpm	f14d81fdf643cdfc89b9b5c161ddada21f52d63a919faa9a8f8efeacaaf58b18	-	ol10_x86_64_appstream
	libsoup3-3.6.5-3.el10_2.20.src.rpm	f14d81fdf643cdfc89b9b5c161ddada21f52d63a919faa9a8f8efeacaaf58b18	-	ol10_x86_64_codeready_builder
	libsoup3-3.6.5-3.el10_2.20.x86_64.rpm	be7114ffa20389b3da5297c923726fab3e61933ee9ea8afb8badf6c1cf56829a	-	ol10_x86_64_appstream
	libsoup3-devel-3.6.5-3.el10_2.20.x86_64.rpm	4816382ff612e6330b483c53c37ce99a2169076652ee18510b2bedad310c81c3	-	ol10_x86_64_appstream
	libsoup3-doc-3.6.5-3.el10_2.20.noarch.rpm	e0821cf3c143ec7cd14bbf7c8716552378944c0ff98e4729c5bf899283e7a4fc	-	ol10_x86_64_codeready_builder

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team