Release date:
2026-10-08 09:28:52 UTC
Description:
- CVE-2026-15709: bound permessage-deflate inflation to the connection's
remaining max-incoming-payload-size allowance in
soup_websocket_extension_deflate_process_incoming_message_with_limit(),
so a compression bomb can no longer allocate without limit before the
post-inflation size check runs
- CVE-2026-15711: reject a WebSocket control frame that declares an extended
payload length in process_frame(), which RFC 6455 section 5.5 forbids
Updated packages:
-
libsoup-2.72.0-10.el9_6.3.tuxcare.els12.aarch64.rpm
sha:bfa371ea4c32becdc7df5aa011af558d34636bda1f445666ef3a61de1b1c74d3
-
libsoup-2.72.0-10.el9_6.3.tuxcare.els12.i686.rpm
sha:58bceec0ddaeda86635b030b635a8deb502f8a22841a0ca3e1779d5cb3cdf471
-
libsoup-2.72.0-10.el9_6.3.tuxcare.els12.x86_64.rpm
sha:1402040933e23816728821f2b1fbd23ed4db56f8b36edc4cb85886d15d490623
-
libsoup-devel-2.72.0-10.el9_6.3.tuxcare.els12.aarch64.rpm
sha:56c99404140dd31e07c902dd57c53196d9452ec4ba927dcd757ea9a3214d4c7d
-
libsoup-devel-2.72.0-10.el9_6.3.tuxcare.els12.i686.rpm
sha:83938502a44644b91cfe6d2e7e9837c65e916b7a53ebc9c0c74a88ae3ad07381
-
libsoup-devel-2.72.0-10.el9_6.3.tuxcare.els12.x86_64.rpm
sha:78105e6548fc49674f624c253c26baae1c5b379bc9f107dbb232d7df96f22830
-
libsoup-doc-2.72.0-10.el9_6.3.tuxcare.els12.noarch.rpm
sha:38ca5276ca0b2505dec24ff1257daf6ba1ab9fe6cee5affb7809431d1d91fb5f
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
