Short answer: Canonical’s USN-8975-1 groups ten vulnerabilities in libsoup2.4 and libsoup3. The issues cover WebSocket parsing and compression, data URIs, HTTP requests, proxy credentials and multipart messages; depending on the CVE, the described impact includes application crashes, possible sensitive-information exposure or arbitrary HTTP request injection. This is a source-backed scope explainer, not proof that every Ubuntu host or application is exposed.
Scope note: This Track A page intentionally contains no update commands, restart instructions, diagnostics, application-inventory procedure or deployment-specific remediation.
What does USN-8975-1 cover?
Canonical published USN-8975-1 on 3 November 2026 for the GNOME HTTP client/server libraries libsoup2.4 and libsoup3. The notice links ten CVEs rather than describing one uniform failure mode: USN-8975-1.
The useful first distinction is the affected protocol surface:
- WebSocket handling: frame parsing, fragmented messages, large messages and compressed messages.
- Data-URI handling: malformed or specially formed data URIs reaching an application through libsoup.
- HTTP request handling: a request-processing issue that Canonical describes as potentially allowing arbitrary HTTP request injection.
- Proxy credentials: incorrect handling that could expose sensitive information.
- Multipart messages: parsing behavior that could crash an application or expose heap contents.
These categories are related because they sit in a network-capable HTTP library, but they are not interchangeable exploit descriptions. A WebSocket frame-length flaw and a multipart parser flaw can have different preconditions, code paths and application consequences.
Why are the WebSocket issues not one vulnerability?
The notice separates several WebSocket failure classes. Some CVEs concern fragmented or large messages, another concerns compressed messages, and CVE-2026-102558 describes a frame-length condition that can lead to a heap buffer overflow when max-incoming-payload-size is unlimited (0). Canonical’s CVE-2026-102558 record gives the detailed mechanism and package status.
That distinction matters for operators and maintainers. Saying “libsoup has a WebSocket vulnerability” is a useful headline, but it is not enough to conclude that every application using libsoup accepts the same input, enables the same extension, or reaches the same parser path. The advisory identifies library-level conditions; application configuration and traffic flow determine whether those conditions are relevant to a deployment.
CVE-2026-102560 is a separate example: Canonical describes a size-calculation flaw when the permessage-deflate WebSocket extension processes a very large outgoing message. Its CVE record should be read independently of the incoming-frame condition in CVE-2026-102558.
What are the non-WebSocket boundaries?
The remaining entries show why the ten-CVE notice should not be reduced to a single “remote crash” label.
CVE-2026-102555 concerns certain data URIs and may cause an application to crash or expose sensitive information. CVE-2026-103399 concerns certain HTTP requests and is described as potentially allowing arbitrary HTTP request injection. CVE-2026-12547 concerns proxy-credential handling and possible sensitive-information exposure.
CVE-2026-12548 covers multipart HTTP parsing. Canonical describes a heap out-of-bounds read caused by an integer type mismatch; a remote attacker could use it to crash an application using libsoup or potentially disclose heap memory contents. See the CVE-2026-12548 record for the source description and status table.
The practical information gain is the boundary map: the library name alone does not tell you whether the relevant input is a WebSocket frame, a compressed message, a data URI, a proxy exchange or a multipart body.
What do the Ubuntu package rows mean?
Ubuntu lists package status separately for libsoup2.4 and libsoup3, and separately for each Ubuntu release. The USN includes current and older releases, with some older package fixes marked as available through Ubuntu Pro or Extended Security Maintenance rather than the standard release channel.
Those rows answer a distribution-maintenance question: what package version or support path does Canonical associate with the fix for that release and package? They do not answer every deployment question. In particular, a package row does not by itself prove that:
- the package is installed on a particular host;
- an application actually loads that library at runtime;
- the application accepts attacker-controlled input on the affected path;
- the host is reachable from the relevant network;
- exploitation occurred.
Do not collapse libsoup2.4 and libsoup3 into one package identity, and do not generalize a fixed row from one Ubuntu release to another distribution or an unlisted build.
What does USN-8975-1 not prove?
The advisory does not establish that every Ubuntu system is vulnerable or that every application using libsoup meets the conditions described by every linked CVE. It also does not provide incident evidence for an individual server.
It does not establish active exploitation, data disclosure or a successful request-injection event on a particular deployment. CVSS scores and the phrase “remote attacker” describe the published vulnerability model; they are not a substitute for application reachability, package inventory, configuration review or incident evidence.
This distinction is especially important for small teams. A security notice is reliable evidence of upstream and distro scope. It is not a deployment report.
How should operators read this notice?
Start with Canonical’s USN-8975-1 for the complete CVE list and Ubuntu package tables. Then open the linked CVE records for any protocol surface that matches an application in your environment. Treat the package and release rows as the authority for Ubuntu scope, while keeping application behavior and network exposure as separate questions.
For broader context, see TheLinuxForum’s secure remote-access field guide, the adjacent libwebsockets security boundary explainer, and Linux server security guidance.
Bottom line
USN-8975-1 is a group advisory for ten libsoup vulnerabilities, not one universal failure mode. Its linked records distinguish WebSocket framing and compression issues from data-URI, HTTP request, proxy-credential and multipart parsing boundaries. Canonical’s package tables establish release-specific distro scope; they do not prove that a particular application is reachable through an affected path or that a host was compromised.
Sources checked 2026-11-07: Canonical USN-8975-1, CVE-2026-102558, CVE-2026-102560 and CVE-2026-12548.