CVE-2026-15709

Name of the Vulnerable Software and Affected Versions libsoup (affected versions not specified)

Description A flaw exists in the WebSocket implementation when utilizing the permessage-deflate extension. The decompression loop inflate() processes data in chunks but does not enforce an upper boundary limit on the output buffer size. Although the max incoming payload size limits the incoming compressed frame size, the system fails to track or limit memory allocation during the decompression process. A check for decompressed size via max total message size is only performed after inflation is complete and is disabled by default for client connections. A remote, unauthenticated attacker can send a small, highly compressed payload, known as a decompression bomb, leading to unbounded memory allocation, an Out-of-Memory (OOM) crash, and a Denial of Service (DoS).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.