Log in / Sign up

Vulnerability details

CVE-2026-15709

Red Hat Enterprise Linux 8

Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of service

CVSS 3.1
7.5High

Official description

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).

CVSS scores

ScoreVersionSourceVector
7.5High 3.1 CVEProject cvelistV5 (CNA) (redhat) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

VendorProductVersionsSource
Red Hat Red Hat Enterprise Linux 8 All CVEProject cvelistV5 (CNA)

References and advisories

12
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-07-14
Last updated
2026-11-05
State
Published
Assigner (CNA)
redhat

Exploit prediction (EPSS)

0.88%
Probability of exploitation in 30 days
59.3%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
Proof of concept
Technical impact
Partial

Weaknesses (CWE)

  • CWE-409
    Improper Handling of Highly Compressed Data (Data Amplification)