[El-errata] ELSA-2026-83618 Important: Oracle Linux 10 libsoup3 security update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-83618

http://linux.oracle.com/errata/ELSA-2026-83618.html

The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:

x86_64:
libsoup3-3.6.5-3.el10_2.20.x86_64.rpm
libsoup3-devel-3.6.5-3.el10_2.20.x86_64.rpm
libsoup3-doc-3.6.5-3.el10_2.20.noarch.rpm

aarch64:
libsoup3-3.6.5-3.el10_2.20.aarch64.rpm
libsoup3-devel-3.6.5-3.el10_2.20.aarch64.rpm
libsoup3-doc-3.6.5-3.el10_2.20.noarch.rpm


SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/libsoup3-3.6.5-3.el10_2.20.src.rpm

Related CVEs:

CVE-2026-102555
CVE-2026-102556
CVE-2026-102557
CVE-2026-102558
CVE-2026-102559
CVE-2026-102560




Description of changes:

[3.6.5-20]
- CVE-2026-102557 libsoup3: libsoup: Heap buffer overflow during WebSocket
  message reassembly

[3.6.5-19]
- CVE-2026-102556 libsoup3: libsoup: Heap buffer overflow from WebSocket
  Pong signal type confusion

[3.6.5-18]
- CVE-2026-102558 libsoup3: libsoup: Heap buffer overflow during WebSocket
  receive-buffer growth

[3.6.5-17]
- CVE-2026-102555 libsoup3: libsoup: Heap buffer overflow via uninitialized
  length in data-URI base64 decoding

[3.6.5-16]
- CVE-2026-102560 libsoup3: libsoup: Heap buffer overflow during outgoing
  permessage-deflate buffer growth

[3.6.5-15]
- CVE-2026-102559 libsoup3: libsoup: Heap buffer overflow during WebSocket
  client-frame masking

[3.6.5-14]
- Fix CVE-2026-85197: http2 crash after connection destroyed

[3.6.5-13]
- Fix CVE-2026-15711: Reject oversized WebSocket control frames

[3.6.5-12]
- Fix CVE-2026-15709: bound decompressed WebSocket message size

[3.6.5-11]
- Add patches for CVE-2026-4271 and CVE-2026-5119