CVE-2026-0716Medium· 4.8▾ TwilightPoC availableA flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. T…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 26.4 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
0.4% → 0.4%
A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or a crash. Applications using libsoup’s WebSocket support with this configuration may be impacted.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-15709High· 7.5A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension
CVE-2026-15711High· 7.5A vulnerability was found in libsoup's WebSocket frame parsing implementation
CVE-2026-12478Medium· 4.8The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected
CVE-2026-85197High· 7.6A flaw was found in libsoup
CVE-2026-80717High· 7.5In the Linux kernel, the following vulnerability has been resolved: sctp: validate Adaptation Indication parameter length The Adaptation Layer Indication parameter contains a fixed 32-bit Adaptation Code Point after its parameter heade…
CVE-2026-64114High· 7.0kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)