CVE-2026-0716 Libsoup: out-of-bounds read in libsoup websocket frame processing
An out-of-bounds read in libsoup's WebSocket processing can expose memory or crash applications when maximum payload size is unset.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-0716?
CVE-2026-0716 is a medium-severity memory corruption vulnerability in Red Hat Enterprise Linux 10, published on 13 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or a crash. Applications using libsoup’s WebSocket support with this configuration may be impacted.
Weakness: CWE-805
Which versions are affected by CVE-2026-0716?
Linux distribution packages (10)
libsoup SUSE:Linux Enterprise Micro 5.2 | All versions | 2.68.4-150200.4.36.1 |
libsoup2 SUSE:Linux Enterprise Micro 5.3 | All versions | 2.74.2-150400.3.34.1 |
libsoup2 SUSE:Linux Enterprise Micro 5.4 | All versions | 2.74.2-150400.3.34.1 |
libsoup2 SUSE:Linux Enterprise Micro 5.5 | All versions | 2.74.2-150400.3.34.1 |
libsoup SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 3.4.4-150600.3.42.1 |
libsoup2 SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 2.74.3-150600.4.33.1 |
libsoup SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 2.62.2-5.40.1 |
libsoup SUSE:Linux Micro 6.1 | All versions | 3.4.4-slfo.1.1_8.1 |
libsoup openSUSE:Leap 15.6 | All versions | 3.4.4-150600.3.42.1 |
libsoup2 openSUSE:Leap 15.6 | All versions | 2.74.3-150600.4.33.1 |
How do I fix CVE-2026-0716?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-0716 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-0716 exists.
Sources
Also known as AZL-74640, AZL-74643, DEBIAN-CVE-2026-0716, ECHO-14e3-a93d-99ba, GHSA-7rq6-mh5f-rp2q, SUSE-SU-2026:0847-1 and 6 more.