A flaw in libsoup’s permessage-deflate WebSocket extension allows a remote attacker to cause a Denial of Service via memory exhaustion. The internal inflate() loop resizes its buffer dynamically without enforcing an upper limit during decompression. Because size checks are either performed only on the compressed wire-payload or executed too late (after inflation completes), a small decompression bomb can trigger an immediate Out-of-Memory (OOM) crash on both client and server applications.