CVE-2026-102555High· 8.2▾ TwilightA flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL byt…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.
libsoup3 (all versions)libsouplibsoup (all versions)libsoup (all versions)libsoup (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
To mitigate this do not pass untrusted data URIs to soup_uri_decode_data_uri().
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102558High· 8.6Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth
CVE-2026-102559High· 8.6Libsoup: libsoup: heap buffer overflow during websocket client-frame masking
CVE-2026-102560High· 8.6Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth
CVE-2026-102557High· 8.6A flaw was found in libsoup
CVE-2026-12478Medium· 4.8The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected
CVE-2026-102556High· 8.6A flaw was found in libsoup