A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:83618 advisory.

    * libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding     (CVE-2026-102555)
      * libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion (CVE-2026-102556)
      * libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly (CVE-2026-102557)
      * libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth (CVE-2026-102558)
      * libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking (CVE-2026-102559)
      * libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth     (CVE-2026-102560)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-83618 advisory.

    - CVE-2026-102557 libsoup3: libsoup: Heap buffer overflow during WebSocket       message reassembly
    - CVE-2026-102556 libsoup3: libsoup: Heap buffer overflow from WebSocket       Pong signal type confusion
    - CVE-2026-102558 libsoup3: libsoup: Heap buffer overflow during WebSocket       receive-buffer growth
    - CVE-2026-102555 libsoup3: libsoup: Heap buffer overflow via uninitialized       length in data-URI base64 decoding
    - CVE-2026-102560 libsoup3: libsoup: Heap buffer overflow during outgoing       permessage-deflate buffer growth
    - CVE-2026-102559 libsoup3: libsoup: Heap buffer overflow during WebSocket       client-frame masking
    - Fix CVE-2026-85197: http2 crash after connection destroyed
    - Fix CVE-2026-15711: Reject oversized WebSocket control frames
    - Fix CVE-2026-15709: bound decompressed WebSocket message size

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:83618 advisory.

    Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access     Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate     packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This     enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion,     very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who     want it), but the SOAP parts were removed long ago.

    Security Fix(es):

    * libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding     (CVE-2026-102555)

    * libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion (CVE-2026-102556)

    * libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly (CVE-2026-102557)

    * libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth (CVE-2026-102558)

    * libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking (CVE-2026-102559)

    * libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth     (CVE-2026-102560)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4616-1 advisory.

    - CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory     leak       (bsc#1271448).
    - CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding     (bsc#1283299).
    - CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
    - CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
    - CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
    - CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
    - CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4631-1 advisory.

    - CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory     leak       (bsc#1271448).
    - CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding     (bsc#1283299).
    - CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
    - CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
    - CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
    - CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
    - CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI
    payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload
    contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the
    returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted
    data URI. (CVE-2026-102555)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI     payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload     contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the     returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted     data URI. (CVE-2026-102555)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
366533	AlmaLinux 10 : libsoup3 (ALSA-2026:83618)	Nessus	Alma Linux Local Security Checks	Local	critical
366321	Oracle Linux 10 : libsoup3 (ELSA-2026-83618)	Nessus	Oracle Linux Local Security Checks	Local	critical
366220	RHEL 10 : libsoup3 (RHSA-2026:83618)	Nessus	Red Hat Local Security Checks	Local	critical
365332	SUSE SLES15 Security Update : libsoup (SUSE-SU-2026:4616-1)	Nessus	SuSE Local Security Checks	Local	critical
365316	SUSE SLED15 / SLES15 Security Update : libsoup (SUSE-SU-2026:4631-1)	Nessus	SuSE Local Security Checks	Local	critical
473205	Echo: libsoup3: security update to 3.6.6-1+e8	Tenable Cloud Security	Echo Local Security Checks	Local	high
473205	Echo: libsoup3: security update to 3.6.6-1+e8	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
351190	Linux Distros Unpatched Vulnerability : CVE-2026-102555	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-102555

high

Tenable Plugins

critical

critical

critical

critical

critical

high

high

high