MajorCritical vulnerability
CVE-2026-102556 (CVSS 8.6)
NVD · officialPublished Sep 29, 2026Risk 37/100
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.
Technical details
CVSS
8.6
AV:NetworkAC:LowPR:NoneUI:NoneC:LowI:LowA:High
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source