CVE-2026-0716: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-0716 is an out-of-bounds read vulnerability in libsoup's WebSocket frame processing that can cause unintended memory exposure or application crashes. The flaw exists in the process_frame() function of SoupWebSocketConnection when max_incoming_payload_size is explicitly set to 0 (a non-default configuration), allowing the library to read memory outside the intended buffer bounds. It was reported by Red Hat on January 8, 2026, and published to NVD on January 13, 2026. Affected products include GNOME libsoup (upstream), Microsoft Azure Linux 3 (azl3_libsoup 3.4.4-12/14), CBL-Mariner 2 (cbl2_libsoup 3.0.4-10/12), and Oracle Solaris 11.4. It carries a CVSS v3.1 base score of 4.8 (Medium), assigned by Red Hat (Red Hat CVE, Red Hat Bugzilla, Oracle Bulletin).

The root cause is classified as CWE-805 (Buffer Access with Incorrect Length Value). The vulnerability resides in the process_frame() function within libsoup's SoupWebSocketConnection implementation: when max_incoming_payload_size is explicitly set to 0 (disabling the payload size limit), improper bounds handling allows the function to read beyond the allocated buffer while processing incoming WebSocket frames. An unauthenticated remote attacker can exploit this by sending crafted WebSocket frames to an application using libsoup's WebSocket support with this non-default configuration, triggering an out-of-bounds read. The attack vector is network-based with high attack complexity, requiring no privileges or user interaction, but dependent on the specific misconfiguration being present (Red Hat Bugzilla, GNOME GitLab).

Successful exploitation can result in unintended memory disclosure — potentially exposing sensitive data held in process memory — or application instability leading to a crash (denial of service). The confidentiality and availability impacts are both rated Low, with no integrity impact, reflecting the limited but real risk of memory content leakage and service disruption. The scope is limited to the affected application process; lateral movement is not a direct consequence, but memory disclosure could expose credentials or session tokens that enable further attacks (Red Hat CVE, Oracle Bulletin).

1. Reconnaissance: Identify applications using libsoup's WebSocket support (e.g., GNOME-based applications, services on Azure Linux 3 or CBL-Mariner 2) that are network-accessible and potentially misconfigured.
2. Verify misconfiguration: Confirm that the target application has max_incoming_payload_size set to 0 (disabled), which is a non-default configuration. This may be inferred from application behavior or documentation.
3. Establish WebSocket connection: Initiate a WebSocket handshake with the target application over the network (no authentication required).
4. Send crafted WebSocket frame: Transmit a specially crafted WebSocket frame with a payload designed to trigger the improper bounds check in process_frame(), causing the library to read beyond the allocated buffer.
5. Observe outcome: Depending on memory layout, the result is either a memory disclosure (out-of-bounds data returned or observable via side channels) or an application crash (denial of service) (Red Hat Bugzilla, GNOME GitLab).

• Network: Unusual or malformed WebSocket frames sent to services using libsoup; unexpected WebSocket connections from unknown external IP addresses to internal services.
• Logs: Application crash logs or core dumps originating from the libsoup SoupWebSocketConnection component; repeated connection attempts followed by abrupt disconnections.
• Process: Unexpected termination (segmentation fault or SIGABRT) of applications linked against libsoup when handling WebSocket traffic; crash reports referencing process_frame() in libsoup stack traces.
• File System: Core dump files generated by libsoup-linked applications in /var/crash/ or application working directories following WebSocket activity.

Patches are available from multiple vendors. Microsoft released updates for Azure Linux 3 (azl3_libsoup) and CBL-Mariner 2 (cbl2_libsoup) on January 17, 2026. Oracle addressed the vulnerability in Oracle Solaris 11.4 as part of the January 2026 Third Party Bulletin. As a temporary workaround, ensure that max_incoming_payload_size is not set to 0 in any libsoup WebSocket configuration — using the default (non-zero) value prevents the vulnerable code path from being triggered. Organizations should prioritize patching systems running affected libsoup versions that expose WebSocket functionality over the network (Microsoft MSRC, Oracle Bulletin, Red Hat CVE).

The vulnerability received routine coverage from Linux security news aggregators and distribution security teams, including SUSE, Fedora, openSUSE, and Amazon Linux, all of which issued advisories and updated packages. Pro-Linux.de published multiple security notices covering libsoup and libsoup2 updates across distributions. No notable researcher commentary or significant social media discussion has been identified beyond standard CVE tracking and distribution patch announcements.