CVE-2026-15709

Deferred Deferred - Pending Action

Memory Exhaustion in libsoup WebSocket Decompression

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: Red Hat, Inc.

Description

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-15709

EUVD

EUVD-2026-44408

Affected Vendors & Products

Vendor	Product	Version / Range
libsoup	libsoup	*
gnome	libsoup	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-409	The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

Executive Summary

This vulnerability is in libsoup's WebSocket permessage-deflate extension. The decompression loop inflates compressed data without limiting output buffer size, allowing a small but highly compressed payload to cause unbounded memory allocation. This triggers an Out-of-Memory crash and Denial of Service.

Detection Guidance

To detect this vulnerability, monitor for abnormal memory usage spikes or OOM crashes in applications using libsoup with WebSocket connections. Check logs for WebSocket-related errors or crashes. Use system monitoring tools like 'top', 'htop', or 'ps' to observe memory consumption by processes linked to libsoup.

Impact Analysis

This vulnerability can cause applications using libsoup's WebSocket extension to crash due to memory exhaustion. It may disrupt services relying on WebSocket connections, leading to downtime or degraded performance for both client and server applications.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions or outages, potentially violating availability requirements in GDPR or HIPAA. Unplanned downtime may lead to data processing delays or breaches of service level agreements.

Mitigation Strategies

Disable the permessage-deflate extension in libsoup if not required. Update libsoup to the latest patched version. For client applications, ensure max_total_message_size is enabled and set to a reasonable limit. Monitor network traffic for suspicious compressed payloads.

Hi! I’m here to help you understand CVE-2026-15709. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70