The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68234 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression     Remote Denial of Service (CVE-2026-15709)

    * libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control     frame protocol violation (CVE-2026-15711)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:68234 advisory.

    * SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression     Remote Denial of Service (CVE-2026-15709)
      * libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control     frame protocol violation (CVE-2026-15711)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1872:12 advisory.

    * SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression     Remote Denial of Service (CVE-2026-15709)
      * libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control     frame protocol violation (CVE-2026-15711)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70599 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression     Remote Denial of Service (CVE-2026-15709)

    * libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control     frame protocol violation (CVE-2026-15711)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if     (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can     send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-     based client when max_incoming_payload_size is set to 0.(CVE-2026-12478)

    A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The     extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary     limit on the output buffer size. While libsoup limits the incoming compressed frame size via     max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate     check for decompressed size (max_total_message_size) exists but executes only after inflation is complete,     and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can     exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded     memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service     (DoS).(CVE-2026-15709)

Tenable has extracted the preceding description block directly from the EulerOS libsoup security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142318 advisory.

    A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The     extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary     limit on the output buffer size. While libsoup limits the incoming compressed frame size via     max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate     check for decompressed size (max_total_message_size) exists but executes only after inflation is complete,     and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can     exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded     memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:98560 advisory.

    * SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression     Remote Denial of Service (CVE-2026-15709)

    * libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control     frame protocol violation (CVE-2026-15711)

    * libsoup: libsoup: Heap use-after-free in libsoup HTTP/2 client on_data_read() via GOAWAY during body     upload (CVE-2026-85197)

    * libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding     (CVE-2026-102555)

    * libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion (CVE-2026-102556)

    * libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly (CVE-2026-102557)

    * libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth (CVE-2026-102558)

    * libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking (CVE-2026-102559)

    * libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth     (CVE-2026-102560)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
346441	RHEL 9 : libsoup (RHSA-2026:68234)	Nessus	Red Hat Local Security Checks	2026/9/16	2026/9/16	high
346871	AlmaLinux 9 : libsoup (ALSA-2026:68234)	Nessus	Alma Linux Local Security Checks	2026/9/17	2026/9/17	high
347925	MiracleLinux 9 : libsoup-2.72.0-16.el9_8.3 (AXSA:2026-1872:12)	Nessus	Miracle Linux Local Security Checks	2026/9/18	2026/9/18	high
349280	RHEL 8 : libsoup (RHSA-2026:70599)	Nessus	Red Hat Local Security Checks	2026/9/23	2026/9/23	high
364749	EulerOS 2.0 SP13 : libsoup (EulerOS-SA-2026-4063)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	medium
365003	EulerOS 2.0 SP11 : libsoup (EulerOS-SA-2026-4339)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	medium
370086	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libsoup (UTSA-2026-142318)	Nessus	Unity Linux Local Security Checks	2026/10/21	2026/10/21	high
380453	RockyLinux 10 : libsoup3 (RLSA-2026:98560)	Nessus	Rocky Linux Local Security Checks	2026/11/13	2026/11/13	critical

检测

插件搜索

high

high

high

high

medium

medium

high

critical