Red Hat Product Errata RHSA-2026:93465 - Security Advisory
Issued:
2026-11-02
Updated:
2026-11-02

RHSA-2026:93465 - Security Advisory

Synopsis

Important: libsoup security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for libsoup is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es):

  • libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion (CVE-2026-102556)
  • libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly (CVE-2026-102557)
  • libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth (CVE-2026-102558)
  • libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking (CVE-2026-102559)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

  • BZ - 2543229 - CVE-2026-102556 libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion
  • BZ - 2543231 - CVE-2026-102557 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly
  • BZ - 2543274 - CVE-2026-102558 libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth
  • BZ - 2543285 - CVE-2026-102559 libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking

Red Hat Enterprise Linux Server - Extended Life Cycle Support 7

SRPM
libsoup-2.62.2-16.el7_9.src.rpm SHA-256: a81c125110a92fc57db92dd73f3573de7e8fac4ce46d0d86ff2fbdd1830ba515
x86_64
libsoup-2.62.2-16.el7_9.i686.rpm SHA-256: d8f505e3679ef45e69652441e02085a43c3db05c7cca9e3211624f84f35ed84c
libsoup-2.62.2-16.el7_9.x86_64.rpm SHA-256: 9a3529c6cf0be12bc90171d1ef7432dc635afe908d327d2c7329ceb50546e9a4
libsoup-debuginfo-2.62.2-16.el7_9.i686.rpm SHA-256: ef0b955d4f6b81ac638e09ce07a835098572aa07cc9cf74bf2285414433c1c34
libsoup-debuginfo-2.62.2-16.el7_9.x86_64.rpm SHA-256: ada47070cf71157fe125f433e979b750695be5daf9d2761387e38e4a218b1652
libsoup-devel-2.62.2-16.el7_9.i686.rpm SHA-256: 7afe9a2e058661b39ee5184a38ce79271b30dc931efa9b36ecac20b015eebfec
libsoup-devel-2.62.2-16.el7_9.x86_64.rpm SHA-256: 3f7b55faba76dc2b891bbcf942e9bd1740ec6363f1559580b69e99f19916a923

Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7

SRPM
libsoup-2.62.2-16.el7_9.src.rpm SHA-256: a81c125110a92fc57db92dd73f3573de7e8fac4ce46d0d86ff2fbdd1830ba515
s390x
libsoup-2.62.2-16.el7_9.s390.rpm SHA-256: d0876907cc0af6d19b72b5afd21a910a04b863d6d1ff3ef5dbc08b8bb09d5b40
libsoup-2.62.2-16.el7_9.s390x.rpm SHA-256: 8fe768a37ddf39bcc78f530edc697e7fa925cf5b0c94fe7476c6f4cfaabc1290
libsoup-debuginfo-2.62.2-16.el7_9.s390.rpm SHA-256: 818c8ce6d3a235ca1dad41d8bacfab921bc9070bb5ce2df960cebda4d28b5920
libsoup-debuginfo-2.62.2-16.el7_9.s390x.rpm SHA-256: 309514bbbbb0797079564e7911b531c4fe7f6c3b8b17dc05dd073ca5d80f6638
libsoup-devel-2.62.2-16.el7_9.s390.rpm SHA-256: 7cd0117a4ca93fd7e02db4ee73a6e5a9914788eb9c4d0d8a91147cc0fafead28
libsoup-devel-2.62.2-16.el7_9.s390x.rpm SHA-256: c8282b60aa240c1a03e7bff2f6038345e4e33473302987b72f972ed7d118850b

Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7

SRPM
libsoup-2.62.2-16.el7_9.src.rpm SHA-256: a81c125110a92fc57db92dd73f3573de7e8fac4ce46d0d86ff2fbdd1830ba515
ppc64
libsoup-2.62.2-16.el7_9.ppc.rpm SHA-256: fb6820ec4389a0c40e6dac8a8f121de9ffffac812c954e1be0d2c86ba8b74ad5
libsoup-2.62.2-16.el7_9.ppc64.rpm SHA-256: 3a1a5fb5d5da3a531a2afb2519c42dea316decf7908db4796b882b8ba38b714d
libsoup-debuginfo-2.62.2-16.el7_9.ppc.rpm SHA-256: c4f586447af688fb895c9bea8388225044f9a0f063fa7b8d23a527d6ab59ea4b
libsoup-debuginfo-2.62.2-16.el7_9.ppc64.rpm SHA-256: ecd7a3b46c25ad79bef7d57b35cfdfc7938f4d4db876f880b03f8f706df57455
libsoup-devel-2.62.2-16.el7_9.ppc.rpm SHA-256: b3fe9c7658396a664894240b3807b5c974eb02dc26ab0c46c91b4b008ffe2dce
libsoup-devel-2.62.2-16.el7_9.ppc64.rpm SHA-256: 57c83b593c5310bd110580c27c5b156bdb550f8bfc24160a3afc3eabe5c4cc8d

Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7

SRPM
libsoup-2.62.2-16.el7_9.src.rpm SHA-256: a81c125110a92fc57db92dd73f3573de7e8fac4ce46d0d86ff2fbdd1830ba515
ppc64le
libsoup-2.62.2-16.el7_9.ppc64le.rpm SHA-256: 45adf183d5fe7020020ff70a83ec5f60fede6c36d194a7f7122aa4caadac99d3
libsoup-debuginfo-2.62.2-16.el7_9.ppc64le.rpm SHA-256: 34ae52bfc114cda6a22b0b962d3c3028efd476c05df86a6c1df55a1d3e96395c
libsoup-devel-2.62.2-16.el7_9.ppc64le.rpm SHA-256: 541d17ec4b691be7c69d8d6177903e994d39961c882c975b1771132234efc074

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.