Release date:
2026-10-07 23:45:53 UTC
Description:
- CVE-2026-15709: bound permessage-deflate inflation to the connection's
remaining max-incoming-payload-size allowance in
soup_websocket_extension_deflate_process_incoming_message_with_limit(),
so a compression bomb can no longer allocate without limit before the
post-inflation size check runs
- CVE-2026-15711: reject a WebSocket control frame that declares an extended
payload length in process_frame(), which RFC 6455 section 5.5 forbids
Updated packages:
-
libsoup-2.72.0-10.el9_2.3.tuxcare.els12.aarch64.rpm
sha:f2ce1c658a21f8c725f1c82de7bb29aef3c06d9370335d9bbb8f61d2cfd4ec81
-
libsoup-2.72.0-10.el9_2.3.tuxcare.els12.i686.rpm
sha:c523748e572f8eb537c68b2e462f93051055a986130aab0687a5d951d9388980
-
libsoup-2.72.0-10.el9_2.3.tuxcare.els12.x86_64.rpm
sha:cd1e540a37980281d645a3444ab61663670ccb5b21854d0f78d8bae963d62403
-
libsoup-devel-2.72.0-10.el9_2.3.tuxcare.els12.aarch64.rpm
sha:d67574704f2fcc600f588fecfbc0da54c4c3fff59a474f2a0f20bf1eb72f8a09
-
libsoup-devel-2.72.0-10.el9_2.3.tuxcare.els12.i686.rpm
sha:4e3765a49c1a9ccb1e2baa3a3701fd5aae3da4dfd465cb571f5994e588845360
-
libsoup-devel-2.72.0-10.el9_2.3.tuxcare.els12.x86_64.rpm
sha:c37dbc3c87e2a5f20b7e96f71a4931012b3c4459502738e477c41821d807547d
-
libsoup-doc-2.72.0-10.el9_2.3.tuxcare.els12.noarch.rpm
sha:c02c80a396a216bca6d17da86cad54efb04ed57ef0e2228c27785b21032ab48d
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
