Log in Start free

Vulnerability · Published Jul 14, 2026 · Assigned by redhat

CVE-2026-15709Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of service

High 7.5

In plain English

A high-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.9%top 40.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9libsoup2.72.0-16.el9_8.3ALSA-2026:68234
AlmaLinux:9libsoup-devel2.72.0-16.el9_8.3ALSA-2026:68234
AlmaLinux:10libsoup33.6.5-3.el10_2.14ALSA-2026:68235
AlmaLinux:10libsoup3-devel3.6.5-3.el10_2.14ALSA-2026:68235
AlmaLinux:10libsoup3-doc3.6.5-3.el10_2.14ALSA-2026:68235
Debian:12libsoup2.4no fix listedDEBIAN-CVE-2026-15709
Debian:13libsoup2.4no fix listedDEBIAN-CVE-2026-15709
Debian:12libsoup3no fix listedDEBIAN-CVE-2026-15709
Debian:13libsoup3no fix listedDEBIAN-CVE-2026-15709
Rocky Linux:9libsoup0:2.72.0-16.el9_8.3RLSA-2026:68234
Ubuntu:22.04:LTSlibsoup2.4no fix listedUBUNTU-CVE-2026-15709
Ubuntu:24.04:LTSlibsoup2.4no fix listedUBUNTU-CVE-2026-15709
Ubuntu:26.10libsoup2.4no fix listedUBUNTU-CVE-2026-15709
Ubuntu:24.04:LTSlibsoup3no fix listedUBUNTU-CVE-2026-15709
Ubuntu:26.04:LTSlibsoup3no fix listedUBUNTU-CVE-2026-15709
Ubuntu:26.10libsoup3no fix listedUBUNTU-CVE-2026-15709

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references

Weakness: CWE-409 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References