CVE-2026-0716

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0716", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-01-08T11:48:19.812Z", "datePublished": "2026-01-13T23:07:06.305Z", "dateUpdated": "2026-11-05T16:10:47.009Z"}, "containers": {"cna": {"title": "Libsoup: out-of-bounds read in libsoup websocket frame processing", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in libsoup\u2019s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or a crash. Applications using libsoup\u2019s WebSocket support with this configuration may be impacted."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libsoup3", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:10"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libsoup", "defaultStatus": "unaffected", "cpes": ["cpe:/o:redhat:rhel_els:6"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libsoup", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:rhel_els:7"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libsoup", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:8"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libsoup", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:9"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-0716", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427896", "name": "RHBZ#2427896", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/476"}], "datePublic": "2026-01-08T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-805", "description": "Buffer Access with Incorrect Length Value", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-805: Buffer Access with Incorrect Length Value", "workarounds": [{"lang": "en", "value": "To mitigate this issue, applications utilizing libsoup's WebSocket support should ensure that the `max_incoming_payload_size` is explicitly set to a non-zero value. This prevents the library from processing WebSocket frames with an unset or zero maximum payload size, which can lead to out-of-bounds reads. Consult application-specific documentation for configuring libsoup parameters."}], "timeline": [{"lang": "en", "time": "2026-01-08T11:39:18.757Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-01-08T00:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-05T16:10:47.009Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-14T14:35:48.532034Z", "id": "CVE-2026-0716", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T14:36:02.731Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0716", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-14T14:35:48.532034Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T14:35:53.934Z"}}], "cna": {"title": "Libsoup: out-of-bounds read in libsoup websocket frame processing", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": ["cpe:/a:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "libsoup3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_els:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "libsoup", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:rhel_els:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "libsoup", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "libsoup", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "libsoup", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-01-08T11:39:18.757Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-01-08T00:00:00.000Z", "value": "Made public."}], "datePublic": "2026-01-08T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-0716", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427896", "name": "RHBZ#2427896", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/476"}], "workarounds": [{"lang": "en", "value": "To mitigate this issue, applications utilizing libsoup's WebSocket support should ensure that the `max_incoming_payload_size` is explicitly set to a non-zero value. This prevents the library from processing WebSocket frames with an unset or zero maximum payload size, which can lead to out-of-bounds reads. Consult application-specific documentation for configuring libsoup parameters."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in libsoup\u2019s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or a crash. Applications using libsoup\u2019s WebSocket support with this configuration may be impacted."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-805", "description": "Buffer Access with Incorrect Length Value"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-05T16:10:47.009Z"}, "x_redhatCweChain": "CWE-805: Buffer Access with Incorrect Length Value"}}, "cveMetadata": {"cveId": "CVE-2026-0716", "state": "PUBLISHED", "dateUpdated": "2026-11-05T16:10:47.009Z", "dateReserved": "2026-01-08T11:48:19.812Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-01-13T23:07:06.305Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:10"], "defaultStatus": "affected", "packageName": "libsoup3", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:6"], "defaultStatus": "unaffected", "packageName": "libsoup", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:7"], "defaultStatus": "affected", "packageName": "libsoup", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "libsoup", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "libsoup", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in libsoup\u2019s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or a crash. Applications using libsoup\u2019s WebSocket support with this configuration may be impacted."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en el procesamiento de tramas WebSocket de libsoup al manejar mensajes entrantes. Si se utiliza una configuraci\u00f3n no predeterminada donde el tama\u00f1o m\u00e1ximo de la carga \u00fatil entrante no est\u00e1 establecido, la biblioteca puede leer memoria fuera de los l\u00edmites previstos. Esto puede causar una exposici\u00f3n de memoria no intencionada o un bloqueo. Las aplicaciones que utilizan el soporte WebSocket de libsoup con esta configuraci\u00f3n pueden verse afectadas."}], "id": "CVE-2026-0716", "lastModified": "2026-11-05T17:17:26.583", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0716", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-14T14:35:48.532034Z", "version": "2.0.3"}}]}, "published": "2026-01-13T23:16:04.163", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-0716"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427896"}, {"source": "secalert@redhat.com", "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/476"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-805"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libsoup: Out-of-Bounds Read in libsoup WebSocket Frame Processing", "id": "2427896", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427896"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L", "status": "draft"}, "cwe": "CWE-805", "details": ["A flaw was found in libsoup\u2019s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or a crash. Applications using libsoup\u2019s WebSocket support with this configuration may be impacted."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, applications utilizing libsoup's WebSocket support should ensure that the `max_incoming_payload_size` is explicitly set to a non-zero value. This prevents the library from processing WebSocket frames with an unset or zero maximum payload size, which can lead to out-of-bounds reads. Consult application-specific documentation for configuring libsoup parameters."}, "name": "CVE-2026-0716", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "libsoup3", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "libsoup", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "libsoup", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "libsoup", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "libsoup", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-01-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-0716\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-0716\nhttps://gitlab.gnome.org/GNOME/libsoup/-/issues/476"], "statement": "This vulnerability is rated Moderate for Red Hat because it requires a non-default configuration where `max_incoming_payload_size` is explicitly set to 0 or unset in libsoup's WebSocket frame processing. In typical Red Hat deployments, this configuration is not enabled by default, limiting the exposure to memory disclosure or application instability.", "threat_severity": "Moderate"}

{"analysis": {"en": {"generated_at": "2026-04-18T06:25:36.357188+00:00", "value": {"mitigation_remediation": ["Configure libsoup applications to set the max_incoming_payload_size parameter to a non\u2011zero value such as 1048576 bytes.", "Verify that all WebSocket\u2011enabled services in the environment have this configuration enabled and document the setting.", "Add defensive checks or logging to detect frames that exceed the configured maximum to aid in monitoring and incident response."], "summary": {"action": "Apply Workaround", "impact": "Memory Disclosure / Crash"}, "threat_synthesis": {"affected_systems": "Red Hat Enterprise Linux 6, 7, 8, 9, and 10 are affected due to the inclusion of the libsoup library. All installations that deploy application code using libsoup\u2019s WebSocket functionality with the default configuration are potentially impacted because the maximum incoming payload size defaults to zero when not explicitly set.", "description_and_impact": "An out-of-bounds read occurs in libsoup\u2019s WebSocket frame processing when the maximum incoming payload size is left unset. The flaw allows the library to read memory beyond the intended bounds, which can expose sensitive data or cause a crash. This weakness is classified as CWE\u2011805 and threatens confidentiality and availability.", "risk_and_exploitability": "The vulnerability has a CVSS score of 4.8, indicating moderate severity, and an EPSS score of less than 1 percent, reflecting a very low probability of exploitation. It has not been added to CISA\u2019s KEV catalog, and no public exploit is known. The most likely attack vector involves an attacker sending specially crafted WebSocket frames to a target application that uses libsoup without configuring a non\u2011zero maximum payload size. If successful, the attacker could read arbitrary memory or trigger a denial\u2011of\u2011service condition. Although the risk remains moderate, the low exploitation probability warrants proactive mitigation."}}}}, "created": "2026-04-18T06:30:25.908645+00:00", "updated": "2026-04-18T06:30:25.908657+00:00", "vendors": []}