CVE-2026-102556 vulnerability in Red Hat Products
Published on September 29, 2026

Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-102556 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

LOW

Integrity Impact:

LOW

Availability Impact:

HIGH

Timeline

2026-09-03

Reported to Red Hat.

2026-09-03

Made public.

Weakness Type

What is an Object Type Confusion Vulnerability?

The program allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

CVE-2026-102556 has been classified to as an Object Type Confusion vulnerability or weakness.

Products Associated with CVE-2026-102556

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Enterprise Linux (RHEL)

Red Hat Enterprise Linux Eus

Red Hat Rhel Els

Red Hat Rhel Aus

Red Hat Rhel Eus Long Life

Red Hat Rhel E4s

Red Hat Rhel Tus

Red Hat Rhel Eus

Affected Versions

Red Hat Enterprise Linux 10:

Version 0:3.6.5-3.el10_2.20 and below * is unaffected.

Red Hat Enterprise Linux 10.0 Extended Update Support:

Version 0:3.6.5-3.el10_0.19 and below * is unaffected.

Red Hat Enterprise Linux 7 Extended Lifecycle Support:

Version 0:2.62.2-16.el7_9 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 0:2.62.3-19.el8_10 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 0:2.62.3-19.el8_10 and below * is unaffected.

Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support:

Version 0:2.62.3-2.el8_4.14 and below * is unaffected.

Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On:

Version 0:2.62.3-2.el8_4.14 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support:

Version 0:2.62.3-2.el8_6.14 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On:

Version 0:2.62.3-2.el8_6.14 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Telecommunications Update Service:

Version 0:2.62.3-3.el8_8.15 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions:

Version 0:2.62.3-3.el8_8.15 and below * is unaffected.

Red Hat Enterprise Linux 9:

Version 0:2.72.0-16.el9_8.8 and below * is unaffected.

Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions:

Version 0:2.72.0-8.el9_2.18 and below * is unaffected.

Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions:

Version 0:2.72.0-8.el9_4.17 and below * is unaffected.

Red Hat Enterprise Linux 9.6 Extended Update Support:

Version 0:2.72.0-10.el9_6.14 and below * is unaffected.

Red Hat Enterprise Linux 6: