CVE-2026-15709: Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of service
A flaw in libsoup’s permessage-deflate WebSocket extension allows a remote attacker to cause a Denial of Service via memory exhaustion. The internal inflate() loop resizes its buffer dynamically without enforcing an upper limit during decompression. Because size checks are either performed only on the compressed wire-payload or executed too late (after inflation completes), a small decompression bomb can trigger an immediate Out-of-Memory (OOM) crash on both client and server applications.
Other sources
A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via maxincomingpayloadsize, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (maxtotalmessagesize) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15709?
The severity of CVE-2026-15709 is rated as high with a score of 7.5.
What impact does CVE-2026-15709 have on my system?
CVE-2026-15709 can lead to a Denial of Service scenario due to memory exhaustion.
How do I fix CVE-2026-15709?
To fix CVE-2026-15709, update libsoup to a version that applies the relevant patch to restrict memory usage during decompression.
Who is affected by CVE-2026-15709?
Any systems using libsoup with the WebSocket permessage-deflate extension are potentially affected by CVE-2026-15709.
What type of attack does CVE-2026-15709 allow?
CVE-2026-15709 allows remote attackers to exploit the vulnerability to cause a Denial of Service.