CVE-2026-15711

Name of the Vulnerable Software and Affected Versions libsoup (affected versions not specified)

Description An issue exists in the WebSocket frame parsing implementation where the library fails to validate length rules defined in RFC 6455 §5.5. This standard requires that all WebSocket control frames, such as PING, PONG, and CLOSE, have a payload size of 125 bytes or less. A remote, unauthenticated attacker can send an oversized control frame that violates this protocol. Instead of terminating the connection, the parser handles the violation improperly, causing an internal processing crash and resulting in a remote denial of service (DoS) for applications using libsoup WebSockets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.