libsoup vulnerabilities in Ubuntu
Original title: USN-8975-1: libsoup vulnerabilities
Two vulnerabilities in libsoup on Ubuntu 22.04, 24.04, 26.04 and 26.10 could let remote attackers cause crashes or expose sensitive information (CVE-2026-12478, CVE-2026-102555).
It was discovered that libsoup incorrectly handled certain WebSocket frames and data URIs. A remote attacker could possibly use this issue to cause an application to crash or expose sensitive information. This issue only affected the listed Ubuntu versions.
Unconfirmed: Whether the vulnerabilities have been fixed is not stated.
- The issues affect WebSocket frames and data URIs.
- The vulnerabilities were discovered in libsoup.
- No fixed version was stated in the notice.
Impact: cause an application to crash or expose sensitive information
- 1.upgrade to a fixed version
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102555 | Out-of-bounds read in libsoup data-URI decoding | 8.2 | — | ||
| CVE-2026-12478 | The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client… | 4.8 | <1% |
From the original article
It was discovered that libsoup incorrectly handled certain WebSocket frames. A remote attacker could possibly use this issue to cause an application to crash or expose sensitive information. This issue only affected Ubuntu 22.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.