An update for libsoup3 is now available for openEuler-24.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4006 Final 1.0 1.0 2026-09-25 Initial 2026-09-25 2026-09-25 openEuler SA Tool V1.0 2026-09-25 libsoup3 security update An update for libsoup3 is now available for openEuler-24.03-LTS-SP1 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. Security Fix(es): A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).(CVE-2026-15709) A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents.(CVE-2026-15712) A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash.(CVE-2026-15713) An update for libsoup3 is now available for openEuler-24.03-LTS-SP1. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High libsoup3 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4006 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-15709 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-15712 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-15713 https://nvd.nist.gov/vuln/detail/CVE-2026-15709 https://nvd.nist.gov/vuln/detail/CVE-2026-15712 https://nvd.nist.gov/vuln/detail/CVE-2026-15713 openEuler-24.03-LTS-SP1 libsoup3-help-3.4.5-26.oe2403sp1.noarch.rpm libsoup3-3.4.5-26.oe2403sp1.aarch64.rpm libsoup3-debuginfo-3.4.5-26.oe2403sp1.aarch64.rpm libsoup3-debugsource-3.4.5-26.oe2403sp1.aarch64.rpm libsoup3-devel-3.4.5-26.oe2403sp1.aarch64.rpm libsoup3-3.4.5-26.oe2403sp1.src.rpm libsoup3-3.4.5-26.oe2403sp1.x86_64.rpm libsoup3-debuginfo-3.4.5-26.oe2403sp1.x86_64.rpm libsoup3-debugsource-3.4.5-26.oe2403sp1.x86_64.rpm libsoup3-devel-3.4.5-26.oe2403sp1.x86_64.rpm A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS). 2026-09-25 CVE-2026-15709 openEuler-24.03-LTS-SP1 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H libsoup3 security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4006 A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents. 2026-09-25 CVE-2026-15712 openEuler-24.03-LTS-SP1 Medium 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H libsoup3 security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4006 A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash. 2026-09-25 CVE-2026-15713 openEuler-24.03-LTS-SP1 Medium 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N libsoup3 security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4006