Red Hat libsoup Updates Expand Across RHEL 8
Tech GuruQuick Answer
Red Hat has fixed two WebSocket denial-of-service flaws in libsoup for the listed RHEL 8.4, 8.6 and 8.8 support streams. Update the matching library package and check the applications that load it, not just the package inventory.
Confirm Scope And Apply The Supported Fix
What to do now: Match installed libsoup RPMs to the exact RHEL minor/support stream, deploy its fixed build, and plan how long-running HTTP/WebSocket consumers will load the updated library.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | RHEL 8.4, 8.6, and 8.8 extended-support libsoup packages |
|---|---|
| Advisory | RHSA-2026:69863 / RHSA-2026:70598 / RHSA-2026:70599 |
| CVEs | CVE-2026-15709, CVE-2026-15711 |
| Authoritative release date | RHSA-2026:69863: 2026-09-22T07:11:02+00:00 (CSAF initial release) RHSA-2026:70598: 2026-09-23T08:13:56+00:00 (CSAF initial release) RHSA-2026:70599: 2026-09-23T08:08:46+00:00 (CSAF initial release) |
| Authority revision date | RHSA-2026:69863: 2026-09-22T07:11:02+00:00 (CSAF revision history) RHSA-2026:70598: 2026-09-23T08:13:56+00:00 (CSAF revision history) RHSA-2026:70599: 2026-09-23T08:08:46+00:00 (CSAF revision history). CSAF generation timestamps are not advisory revision dates. |
| Affected versions | The exact entitled RHEL 8.4, 8.6, and 8.8 extended-support packages before their advisory-listed fixed builds |
| Fixed version | libsoup 2.62.3-2.el8_4.10, 2.62.3-2.el8_6.10, or 2.62.3-3.el8_8.11 |
| CVSS base score | 7.5 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | The checked libsoup advisories does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
CVE-2026-15709 allows unbounded decompression through WebSocket permessage-deflate; CVE-2026-15711 concerns oversized control frames. Both published vectors have availability impact and a 7.5 score. Red Hat's advisory rating is Moderate, a different rating system from CVSS High.
What To Validate Now
- Inventory. Locate RHEL 8.4, 8.6, and 8.8 extended-support libsoup packages deployments, package versions, enabled services, owners, and dependent workloads.
- Establish applicability. Compare each deployment with the authority's affected-version statement: The exact entitled RHEL 8.4, 8.6, and 8.8 extended-support packages before their advisory-listed fixed builds. Do not infer applicability from product family or severity alone.
- Remediate. Use libsoup 2.62.3-2.el8_4.10 for the covered 8.4 stream, 2.62.3-2.el8_6.10 for 8.6, or 2.62.3-3.el8_8.11 for 8.8. Keep the matching support repository and architecture.
- Validate. Record installed RPM releases and refreshed consumer processes. Test representative HTTP requests, WebSocket connections, normal compressed messages and reconnect behavior; monitor resource usage and application errors.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Red Hat says mitigations are unavailable or do not meet its ease-of-deployment, applicability or stability criteria. Do not represent an untested proxy rule or feature toggle as a complete substitute for the update. Test dependent applications and rollback before broad deployment.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
