The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4616-1 advisory.

    - CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory     leak       (bsc#1271448).
    - CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding     (bsc#1283299).
    - CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
    - CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
    - CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
    - CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
    - CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4739-1 advisory.

    - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after     proxy switch       (bsc#1272195).
    - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame     protocol       violation (bsc#1271446).
    - CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory     leak       (bsc#1271448).
    - CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in     soup_multipart_input_stream_read_headers via       an oversized multipart boundary string (bsc#1271449).
    - CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT     tunnels       (bsc#1273156).
    - CVE-2026-77014: Integer truncation in sort_ranges() comparator causes silent omission of HTTP Range     responses       (bsc#1275988).
    - CVE-2026-77680: quadratic CPU denial of service in HTTP Range coalescing after the CVE-2025-32907 fix     (bsc#1276759).
    - CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
    - CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
    - CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
    - CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
    - CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).
    - CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request     smuggling       (bsc#1283831).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8975-1 advisory.

    It was discovered that libsoup incorrectly handled certain WebSocket frames. A remote attacker could     possibly use this issue to cause an application to crash or expose sensitive information. This issue only     affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-12478)

    It was discovered that libsoup incorrectly handled certain data URIs. A remote attacker could possibly use     this issue to cause an application to crash or expose sensitive information. This issue only affected     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-102555)

    It was discovered that libsoup incorrectly handled certain WebSocket messages. A remote attacker could     possibly use this issue to cause an application to crash. This issue only affected Ubuntu 18.04 LTS,     Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.
    (CVE-2026-102556)

    It was discovered that libsoup incorrectly handled fragmented WebSocket messages. A remote attacker could     possibly use this issue to cause an application to crash. (CVE-2026-102557)

    It was discovered that libsoup incorrectly handled certain WebSocket frames. A remote attacker could     possibly use this issue to cause an application to crash. This issue only affected Ubuntu 18.04 LTS,     Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.
    (CVE-2026-102558)

    It was discovered that libsoup incorrectly handled large WebSocket messages. An attacker could possibly     use this issue to cause an application to crash. (CVE-2026-102559)

    It was discovered that libsoup incorrectly handled compressed WebSocket messages. An attacker could     possibly use this issue to cause an application to crash. This issue only affected Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-102560)

    It was discovered that libsoup did not properly handle certain HTTP requests. A remote attacker could     possibly use this issue to inject arbitrary HTTP requests. (CVE-2026-103399)

    It was discovered that libsoup incorrectly handled proxy credentials. A remote attacker could possibly use     this issue to obtain sensitive information. (CVE-2026-12547)

    It was discovered that libsoup incorrectly handled multipart messages. A remote attacker could possibly     use this issue to cause an application to crash or obtain sensitive information. (CVE-2026-12548)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
365332	SUSE SLES15 Security Update : libsoup (SUSE-SU-2026:4616-1)	Nessus	SuSE Local Security Checks	2026/10/13	2026/10/23	critical
367745	SUSE SLES15: libsoup-2_4-1 / libsoup2-devel / libsoup2-lang / etc (SUSE-SU-2026:4739-1)	Nessus	SuSE Local Security Checks	2026/10/20	2026/10/23	critical
375783	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : libsoup vulnerabilities (USN-8975-1)	Nessus	Ubuntu Local Security Checks	2026/11/4	2026/11/4	critical

偵測

搜尋 Plugin

critical

critical

critical