A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8975-1 advisory.

    It was discovered that libsoup incorrectly handled certain WebSocket frames. A remote attacker could     possibly use this issue to cause an application to crash or expose sensitive information. This issue only     affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-12478)

    It was discovered that libsoup incorrectly handled certain data URIs. A remote attacker could possibly use     this issue to cause an application to crash or expose sensitive information. This issue only affected     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-102555)

    It was discovered that libsoup incorrectly handled certain WebSocket messages. A remote attacker could     possibly use this issue to cause an application to crash. This issue only affected Ubuntu 18.04 LTS,     Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.
    (CVE-2026-102556)

    It was discovered that libsoup incorrectly handled fragmented WebSocket messages. A remote attacker could     possibly use this issue to cause an application to crash. (CVE-2026-102557)

    It was discovered that libsoup incorrectly handled certain WebSocket frames. A remote attacker could     possibly use this issue to cause an application to crash. This issue only affected Ubuntu 18.04 LTS,     Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.
    (CVE-2026-102558)

    It was discovered that libsoup incorrectly handled large WebSocket messages. An attacker could possibly     use this issue to cause an application to crash. (CVE-2026-102559)

    It was discovered that libsoup incorrectly handled compressed WebSocket messages. An attacker could     possibly use this issue to cause an application to crash. This issue only affected Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-102560)

    It was discovered that libsoup did not properly handle certain HTTP requests. A remote attacker could     possibly use this issue to inject arbitrary HTTP requests. (CVE-2026-103399)

    It was discovered that libsoup incorrectly handled proxy credentials. A remote attacker could possibly use     this issue to obtain sensitive information. (CVE-2026-12547)

    It was discovered that libsoup incorrectly handled multipart messages. A remote attacker could possibly     use this issue to cause an application to crash or obtain sensitive information. (CVE-2026-12548)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f06a7887af advisory.

    Fixes a few CVEs:

    - CVE-2026-102560
    - CVE-2026-102559
    - CVE-2026-102558
    - CVE-2026-102555
    - CVE-2026-102556
    - CVE-2026-102557
    - CVE-2026-85197
    - CVE-2026-103399
    - CVE-2026-85534
    - CVE-2026-3633
    - CVE-2026-3099

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93583 advisory.

    Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access     Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate     packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This     enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion,     very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who     want it), but the SOAP parts were removed long ago.

    Security Fix(es):

    * libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding     (CVE-2026-102555)

    * libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion (CVE-2026-102556)

    * libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly (CVE-2026-102557)

    * libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth (CVE-2026-102558)

    * libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking (CVE-2026-102559)

    * libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth     (CVE-2026-102560)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22181-1 advisory.

    - CVE-2026-12547: Header Proxy-Authorization leads to credentials being send to different proxy after     proxy switch       (bsc#1272195).
    - CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation (bsc#1272196).
    - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame     protocol       violation (bsc#1271446).
    - CVE-2026-15712: SoupClientMessageIOHTTP2: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid     NUL-       termination assumption (bsc#1271447).
    - CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory     leak       (bsc#1271448).
    - CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in     soup_multipart_input_stream_read_headers       via an oversized multipart boundary string (bsc#1271449).
    - CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT     tunnels       (bsc#1273156).
    - CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding     (bsc#1283299).
    - CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
    - CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
    - CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
    - CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
    - CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).
    - CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request     smuggling       (bsc#1283831).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792599160 advisory.

  - A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI     payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload     contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the     returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted     data URI. (CVE-2026-102555)

  - A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection     emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes.
    Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a     crash upon receiving a crafted Pong. (CVE-2026-102556)

  - A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup     did not adequately cap total message size against the limits of the underlying buffer type. A remote peer     could send fragments that caused size truncation while the implementation still used the full length,     leading to heap corruption or a crash. (CVE-2026-102557)

  - A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection     could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped,     causing a heap buffer overflow while reading frame data. (CVE-2026-102558)

  - A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing     payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine     still used the full length, causing a heap buffer overflow. (CVE-2026-102559)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792600325 advisory.

  - A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI     payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload     contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the     returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted     data URI. (CVE-2026-102555)

  - A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection     emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes.
    Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a     crash upon receiving a crafted Pong. (CVE-2026-102556)

  - A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup     did not adequately cap total message size against the limits of the underlying buffer type. A remote peer     could send fragments that caused size truncation while the implementation still used the full length,     leading to heap corruption or a crash. (CVE-2026-102557)

  - A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection     could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped,     causing a heap buffer overflow while reading frame data. (CVE-2026-102558)

  - A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing     payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine     still used the full length, causing a heap buffer overflow. (CVE-2026-102559)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792600325 advisory.

  - A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI     payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload     contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the     returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted     data URI. (CVE-2026-102555)

  - A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection     emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes.
    Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a     crash upon receiving a crafted Pong. (CVE-2026-102556)

  - A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup     did not adequately cap total message size against the limits of the underlying buffer type. A remote peer     could send fragments that caused size truncation while the implementation still used the full length,     leading to heap corruption or a crash. (CVE-2026-102557)

  - A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection     could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped,     causing a heap buffer overflow while reading frame data. (CVE-2026-102558)

  - A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing     payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine     still used the full length, causing a heap buffer overflow. (CVE-2026-102559)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:83618 advisory.

    * libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding     (CVE-2026-102555)
      * libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion (CVE-2026-102556)
      * libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly (CVE-2026-102557)
      * libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth (CVE-2026-102558)
      * libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking (CVE-2026-102559)
      * libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth     (CVE-2026-102560)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-83618 advisory.

    - CVE-2026-102557 libsoup3: libsoup: Heap buffer overflow during WebSocket       message reassembly
    - CVE-2026-102556 libsoup3: libsoup: Heap buffer overflow from WebSocket       Pong signal type confusion
    - CVE-2026-102558 libsoup3: libsoup: Heap buffer overflow during WebSocket       receive-buffer growth
    - CVE-2026-102555 libsoup3: libsoup: Heap buffer overflow via uninitialized       length in data-URI base64 decoding
    - CVE-2026-102560 libsoup3: libsoup: Heap buffer overflow during outgoing       permessage-deflate buffer growth
    - CVE-2026-102559 libsoup3: libsoup: Heap buffer overflow during WebSocket       client-frame masking
    - Fix CVE-2026-85197: http2 crash after connection destroyed
    - Fix CVE-2026-15711: Reject oversized WebSocket control frames
    - Fix CVE-2026-15709: bound decompressed WebSocket message size

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:83618 advisory.

    Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access     Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate     packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This     enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion,     very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who     want it), but the SOAP parts were removed long ago.

    Security Fix(es):

    * libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding     (CVE-2026-102555)

    * libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion (CVE-2026-102556)

    * libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly (CVE-2026-102557)

    * libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth (CVE-2026-102558)

    * libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking (CVE-2026-102559)

    * libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth     (CVE-2026-102560)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4616-1 advisory.

    - CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory     leak       (bsc#1271448).
    - CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding     (bsc#1283299).
    - CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
    - CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
    - CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
    - CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
    - CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4631-1 advisory.

    - CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory     leak       (bsc#1271448).
    - CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding     (bsc#1283299).
    - CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
    - CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
    - CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
    - CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
    - CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI
    payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload
    contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the
    returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted
    data URI. (CVE-2026-102555)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI     payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload     contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the     returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted     data URI. (CVE-2026-102555)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
375783	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : libsoup vulnerabilities (USN-8975-1)	Nessus	Ubuntu Local Security Checks	Local	critical
375405	Fedora 44 : libsoup3 (2026-f06a7887af)	Nessus	Fedora Local Security Checks	Local	critical
375150	RHEL 10 : libsoup3 (RHSA-2026:93583)	Nessus	Red Hat Local Security Checks	Local	critical
374749	openSUSE 16 Security Update : libsoup (openSUSE-SU-2026:22181-1)	Nessus	SuSE Local Security Checks	Local	critical
369963	AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792599160)	Nessus	Alma Linux Local Security Checks	Local	critical
369959	Rocky Linux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792600325)	Nessus	Rocky Linux Local Security Checks	Local	critical
369956	AlmaLinux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792600325)	Nessus	Alma Linux Local Security Checks	Local	critical
366533	AlmaLinux 10 : libsoup3 (ALSA-2026:83618)	Nessus	Alma Linux Local Security Checks	Local	critical
366321	Oracle Linux 10 : libsoup3 (ELSA-2026-83618)	Nessus	Oracle Linux Local Security Checks	Local	critical
366220	RHEL 10 : libsoup3 (RHSA-2026:83618)	Nessus	Red Hat Local Security Checks	Local	critical
365332	SUSE SLES15 Security Update : libsoup (SUSE-SU-2026:4616-1)	Nessus	SuSE Local Security Checks	Local	critical
365316	SUSE SLED15 / SLES15 Security Update : libsoup (SUSE-SU-2026:4631-1)	Nessus	SuSE Local Security Checks	Local	critical
473205	Echo: libsoup3: security update to 3.6.6-1+e8	Tenable Cloud Security	Echo Local Security Checks	Local	high
473205	Echo: libsoup3: security update to 3.6.6-1+e8	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
351190	Linux Distros Unpatched Vulnerability : CVE-2026-102555	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-102555

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high