https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T14:51:06.857027+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-369154 EUVD-2026-369154 2026-10-04T14:51:07.665199+00:00 EUVD-2026-369154 https://cve.radiocsirt.org/vuln/fkie_cve-2026-12478 fkie_cve-2026-12478 2026-10-04T14:51:07.665238+00:00

The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.

 https://cve.radiocsirt.org/vuln/ghsa-6jpc-6452-qwq2 GHSA-6jpc-6452-qwq2 2026-10-04T14:51:07.665272+00:00

The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.

 https://cve.radiocsirt.org/vuln/oesa-2026-3380 OESA-2026-3380 — libsoup security update 2026-10-04T14:51:07.665290+00:00

Affected: openEuler:22.03-LTS-SP4: libsoup

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fix(es):

The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.(CVE-2026-12478)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11316-1 openSUSE-SU-2026:11316-1 — libsoup-3_0-0-3.6.6-7.1 on GA media 2026-10-04T14:51:07.665318+00:00

libsoup-3_0-0-3.6.6-7.1 on GA media

 https://cve.radiocsirt.org/vuln/suse-su-2026:22920-1 SUSE-SU-2026:22920-1 — Security update for libsoup 2026-10-04T14:51:07.665336+00:00

Security update for libsoup

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-12478 UBUNTU-CVE-2026-12478 2026-10-04T14:51:07.665351+00:00

Affected: Ubuntu:Pro:22.04:LTS: libsoup3, Ubuntu:24.04:LTS: libsoup3, Ubuntu:26.04:LTS: libsoup3

The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.