CVE-2026-15711

Deferred Deferred - Pending Action

WebSocket Control Frame Parsing DoS in libsoup

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: Red Hat, Inc.

Description

A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-15711

EUVD

EUVD-2026-44428

Affected Vendors & Products

Vendor	Product	Version / Range
gnome	libsoup	*
libsoup	libsoup	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is in libsoup's WebSocket frame parsing. It fails to enforce RFC 6455 rules, which require control frames like PING, PONG, or CLOSE to be 125 bytes or less. Attackers can send oversized frames to crash the parser, causing a denial of service.

Detection Guidance

Monitor WebSocket connections for oversized control frames (PING, PONG, CLOSE) exceeding 125 bytes. Use packet capture tools like tcpdump or Wireshark to inspect WebSocket frames for protocol violations. Check application logs for crashes or connection terminations during WebSocket operations.

Impact Analysis

If you use applications relying on libsoup for WebSocket connections, this flaw could allow remote attackers to crash those services by sending specially crafted oversized frames. This disrupts functionality and may cause downtime.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions in applications handling sensitive data. Downtime may lead to violations of availability requirements in GDPR or HIPAA, depending on the affected system's role.

Mitigation Strategies

Update libsoup to the latest patched version. If immediate patching is not possible, implement network-level filtering to block oversized WebSocket control frames. Disable WebSocket functionality in libsoup if not required. Monitor for exploitation attempts and crashes.

Hi! I’m here to help you understand CVE-2026-15711. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70