CVE-2026-15709: Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of service

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-14 · updated 2026-09-24
Weakness: CWE-409

Description

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).

Affected products

Red Hat Enterprise Linux 10: all versions — fixed in 0:3.6.5-3.el10_2.14
Red Hat Enterprise Linux 10.0 Extended Update Support: all versions — fixed in 0:3.6.5-3.el10_0.17
Red Hat Enterprise Linux 8: all versions
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: all versions — fixed in 0:2.62.3-2.el8_4.10
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: all versions — fixed in 0:2.62.3-2.el8_4.10
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: all versions — fixed in 0:2.62.3-2.el8_6.10
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On: all versions — fixed in 0:2.62.3-2.el8_6.10
Red Hat Enterprise Linux 8.8 Telecommunications Update Service: all versions — fixed in 0:2.62.3-3.el8_8.11
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: all versions — fixed in 0:2.62.3-3.el8_8.11
Red Hat Enterprise Linux 9: all versions — fixed in 0:2.72.0-16.el9_8.3
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 0:2.72.0-8.el9_2.13
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: all versions — fixed in 0:2.72.0-8.el9_4.12
Red Hat Enterprise Linux 9.6 Extended Update Support: all versions — fixed in 0:2.72.0-10.el9_6.9

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 0:3.6.5-3.el10_2.14; Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.6.5-3.el10_0.17; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:2.62.3-2.el8_4.10; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:2.62.3-2.el8_4.10; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:2.62.3-2.el8_6.10; Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:2.62.3-2.el8_6.10; Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:2.62.3-3.el8_8.11; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:2.62.3-3.el8_8.11; Red Hat Enterprise Linux 9 0:2.72.0-16.el9_8.3; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:2.72.0-8.el9_2.13; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:2.72.0-8.el9_4.12; Red Hat Enterprise Linux 9.6 Extended Update Support 0:2.72.0-10.el9_6.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-15709 or the next vulnerability affects your stack