It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3212 advisory.

    A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection     emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes.
    Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a     crash upon receiving a crafted Pong. (CVE-2026-102556)

    A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup     did not adequately cap total message size against the limits of the underlying buffer type. A remote peer     could send fragments that caused size truncation while the implementation still used the full length,     leading to heap corruption or a crash. (CVE-2026-102557)

    A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection     could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped,     causing a heap buffer overflow while reading frame data. (CVE-2026-102558)

    A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing     payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine     still used the full length, causing a heap buffer overflow. (CVE-2026-102559)

    A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large     outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write     past the allocated buffer and resulting in a heap buffer overflow. (CVE-2026-102560)

    A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect:
    100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body     is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive     connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated     attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled     request, leading to unintended request handling. (CVE-2026-103399)

    An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists     in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which     does not adequately restrict or validate the size of incoming multipart boundary strings. When processing     a crafted HTTP response containing a malformed or oversized boundary parameter, the internal stream reader     reads past the allocated buffer bounds. A remote, unauthenticated attacker can exploit this behavior to     cause a service denial (DoS) through application failure or potentially read fragments of unauthorized     memory metadata. (CVE-2026-15714)

    A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until()     function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can     exploit this by sending a crafted multipart response, potentially causing the client application to crash     or disclose sensitive heap memory. (CVE-2026-66337)

    A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for     chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign     prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this     parsing differential can be exploited to smuggle HTTP requests. (CVE-2026-66338)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : libsoup, libsoup-devel (ALAS2023-2026-3212)

critical Nessus Plugin ID 365275

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Oct 23, 2026, 5:56 PM Plugin metadata (Add IAVM Info) Plugin Feed: 202610231756
Version 1.2 Oct 19, 2026, 10:23 AM CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 9.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSSv2 score source (changed from "CVE-2026-66338" to "CVE-2026-102560") CVSSv2 severity (based on CVE-2026-102560, severity increased from "Medium" to "High") Plugin Feed: 202610191023
Version 1.1 Oct 13, 2026, 2:52 AM New Plugin Feed: 202610130252