Vulnerability-Lookup

RHSA-2026:68234

Vulnerability from csaf_opensuse - Published: 2026-09-16 00:00 - Updated: 2026-09-17 18:32

Summary

security update for libsoup

Severity

Moderate

Notes

Title of the patch: security update for libsoup

Description of the patch: This security update provides a functional equivalent of RHSA-2026:68234. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:68234.

Patchnames: RHSA-2026:68234

CVE-2026-15709

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 9:libsoup-0:2.72.0-16.el9_8.3.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:libsoup-0:2.72.0-16.el9_8.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:libsoup-devel-0:2.72.0-16.el9_8.3.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:libsoup-devel-0:2.72.0-16.el9_8.3.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-15711

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products, the same list as for CVE-2026-15709

Threats

Impact important

References

10 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://www.suse.com/security/cve/CVE-2026-15709/	self
https://www.suse.com/security/cve/CVE-2026-15711/	self
https://www.suse.com/security/cve/CVE-2026-15709	external
https://bugzilla.suse.com/1271445	external
https://www.suse.com/security/cve/CVE-2026-15711	external
https://bugzilla.suse.com/1271446	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for libsoup",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2026:68234.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:68234.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2026:68234",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_68234.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2026:68234",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-September/007862.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2026:68234",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-September/007862.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-15709 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-15709/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-15711 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-15711/"
      }
    ],
    "title": "security update for libsoup",
    "tracking": {
      "current_release_date": "2026-09-17T18:32:15Z",
      "generator": {
        "date": "2026-09-16T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2026:68234",
      "initial_release_date": "2026-09-16T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-09-16T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-17T14:39:22Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T18:32:15Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-0:2.72.0-16.el9_8.3.i686",
                "product": {
                  "name": "libsoup-0:2.72.0-16.el9_8.3.i686",
                  "product_id": "libsoup-0:2.72.0-16.el9_8.3.i686",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnome:libsoup:2.72.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libsoup@2.72.0-16.el9_8.3?arch=i686\u0026upstream=libsoup-0:2.72.0-16.el9_8.3.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.72.0-16.el9_8.3.i686",
                "product": {
                  "name": "libsoup-devel-0:2.72.0-16.el9_8.3.i686",
                  "product_id": "libsoup-devel-0:2.72.0-16.el9_8.3.i686",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnome:libsoup:2.72.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libsoup-devel@2.72.0-16.el9_8.3?arch=i686\u0026upstream=libsoup-0:2.72.0-16.el9_8.3.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libsoup-0:2.72.0-16.el9_8.3.x86_64",
                "product": {
                  "name": "libsoup-0:2.72.0-16.el9_8.3.x86_64",
                  "product_id": "libsoup-0:2.72.0-16.el9_8.3.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnome:libsoup:2.72.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libsoup@2.72.0-16.el9_8.3?arch=x86_64\u0026upstream=libsoup-0:2.72.0-16.el9_8.3.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libsoup-devel-0:2.72.0-16.el9_8.3.x86_64",
                "product": {
                  "name": "libsoup-devel-0:2.72.0-16.el9_8.3.x86_64",
                  "product_id": "libsoup-devel-0:2.72.0-16.el9_8.3.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnome:libsoup:2.72.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libsoup-devel@2.72.0-16.el9_8.3?arch=x86_64\u0026upstream=libsoup-0:2.72.0-16.el9_8.3.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 9",
                "product": {
                  "name": "SUSE Liberty Linux 9",
                  "product_id": "SUSE Liberty Linux 9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.72.0-16.el9_8.3.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:libsoup-0:2.72.0-16.el9_8.3.i686"
        },
        "product_reference": "libsoup-0:2.72.0-16.el9_8.3.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-0:2.72.0-16.el9_8.3.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:libsoup-0:2.72.0-16.el9_8.3.x86_64"
        },
        "product_reference": "libsoup-0:2.72.0-16.el9_8.3.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.72.0-16.el9_8.3.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:libsoup-devel-0:2.72.0-16.el9_8.3.i686"
        },
        "product_reference": "libsoup-devel-0:2.72.0-16.el9_8.3.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libsoup-devel-0:2.72.0-16.el9_8.3.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:libsoup-devel-0:2.72.0-16.el9_8.3.x86_64"
        },
        "product_reference": "libsoup-devel-0:2.72.0-16.el9_8.3.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-15709",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-15709"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in libsoup\u0027s WebSocket implementation when using the permessage-deflate extension. The extension\u0027s decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:libsoup-0:2.72.0-16.el9_8.3.i686",
          "SUSE Liberty Linux 9:libsoup-0:2.72.0-16.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:libsoup-devel-0:2.72.0-16.el9_8.3.i686",
          "SUSE Liberty Linux 9:libsoup-devel-0:2.72.0-16.el9_8.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-15709",
          "url": "https://www.suse.com/security/cve/CVE-2026-15709"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271445 for CVE-2026-15709",
          "url": "https://bugzilla.suse.com/1271445"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:libsoup-0:2.72.0-16.el9_8.3.i686",
            "SUSE Liberty Linux 9:libsoup-0:2.72.0-16.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libsoup-devel-0:2.72.0-16.el9_8.3.i686",
            "SUSE Liberty Linux 9:libsoup-devel-0:2.72.0-16.el9_8.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:libsoup-0:2.72.0-16.el9_8.3.i686",
            "SUSE Liberty Linux 9:libsoup-0:2.72.0-16.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libsoup-devel-0:2.72.0-16.el9_8.3.i686",
            "SUSE Liberty Linux 9:libsoup-devel-0:2.72.0-16.el9_8.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-16T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-15709"
    },
    {
      "cve": "CVE-2026-15711",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-15711"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in libsoup\u0027s WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 \u003cparagraph\u003e5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:libsoup-0:2.72.0-16.el9_8.3.i686",
          "SUSE Liberty Linux 9:libsoup-0:2.72.0-16.el9_8.3.x86_64",
          "SUSE Liberty Linux 9:libsoup-devel-0:2.72.0-16.el9_8.3.i686",
          "SUSE Liberty Linux 9:libsoup-devel-0:2.72.0-16.el9_8.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-15711",
          "url": "https://www.suse.com/security/cve/CVE-2026-15711"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271446 for CVE-2026-15711",
          "url": "https://bugzilla.suse.com/1271446"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:libsoup-0:2.72.0-16.el9_8.3.i686",
            "SUSE Liberty Linux 9:libsoup-0:2.72.0-16.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libsoup-devel-0:2.72.0-16.el9_8.3.i686",
            "SUSE Liberty Linux 9:libsoup-devel-0:2.72.0-16.el9_8.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:libsoup-0:2.72.0-16.el9_8.3.i686",
            "SUSE Liberty Linux 9:libsoup-0:2.72.0-16.el9_8.3.x86_64",
            "SUSE Liberty Linux 9:libsoup-devel-0:2.72.0-16.el9_8.3.i686",
            "SUSE Liberty Linux 9:libsoup-devel-0:2.72.0-16.el9_8.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-16T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-15711"
    }
  ]
}

CVE-2026-15709 (GCVE-0-2026-15709)

Vulnerability from cvelistv5 – Published: 2026-07-14 19:41 – Updated: 2026-09-17 18:39

Title

Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of service

Summary

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-15 12:58 UTC

CWE

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

Assigner

redhat redhat root

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:68234	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:68235	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:68612	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-15709	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2499922	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/libsoup/-/issues/511

Impacted products

6 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.6.5-3.el10_2.14 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.72.0-16.el9_8.3 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:2.72.0-10.el9_6.9 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6::appstream
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8

Date Public

2026-07-14 09:42

Credits

Red Hat would like to thank Tristan Madani for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15709",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T12:58:14.451474Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T12:58:18.795Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/511"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup3",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.5-3.el10_2.14",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-16.el9_8.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-10.el9_6.9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Tristan Madani for reporting this issue."
        }
      ],
      "datePublic": "2026-07-14T09:42:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libsoup\u0027s WebSocket implementation when using the permessage-deflate extension. The extension\u0027s decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-409",
              "description": "Improper Handling of Highly Compressed Data (Data Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T18:39:48.800Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:68234",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:68234"
        },
        {
          "name": "RHSA-2026:68235",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:68235"
        },
        {
          "name": "RHSA-2026:68612",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:68612"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-15709"
        },
        {
          "name": "RHBZ#2499922",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499922"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/511"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-14T09:34:32.593Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-14T09:42:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of service",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-15709",
    "datePublished": "2026-07-14T19:41:37.331Z",
    "dateReserved": "2026-07-14T09:32:47.038Z",
    "dateUpdated": "2026-09-17T18:39:48.800Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15711 (GCVE-0-2026-15711)

Vulnerability from cvelistv5 – Published: 2026-07-14 19:45 – Updated: 2026-09-17 18:39

Title

Libsoup: soupwebsocketconnection: libsoup: websocket remote denial of service via oversized control frame protocol violation

Summary

A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-15 14:10 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

redhat redhat root

References

7 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:68234	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:68235	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:68266	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:68612	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-15711	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2499924	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/libsoup/-/issues/515

Impacted products

6 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:3.6.5-3.el10_2.14 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:2.62.3-15.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.72.0-16.el9_8.3 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:2.72.0-10.el9_6.9 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6::appstream
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7

Date Public

2026-07-14 09:52

Credits

Red Hat would like to thank Sebastián Alba Vives (@Sebasteuo / 0xS4bb1) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15711",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T14:10:43.407984Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T14:11:08.927Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/515"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup3",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.5-3.el10_2.14",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-15.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.62.3-15.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-16.el9_8.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.72.0-10.el9_6.9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "libsoup",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Sebasti\u00e1n Alba Vives (@Sebasteuo / 0xS4bb1) for reporting this issue."
        }
      ],
      "datePublic": "2026-07-14T09:52:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in libsoup\u0027s WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 \u00a75.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T18:39:55.069Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:68234",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:68234"
        },
        {
          "name": "RHSA-2026:68235",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:68235"
        },
        {
          "name": "RHSA-2026:68266",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:68266"
        },
        {
          "name": "RHSA-2026:68612",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:68612"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-15711"
        },
        {
          "name": "RHBZ#2499924",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499924"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libsoup/-/issues/515"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-14T09:46:13.021Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-14T09:52:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libsoup: soupwebsocketconnection: libsoup: websocket remote denial of service via oversized control frame protocol violation",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-770: Allocation of Resources Without Limits or Throttling"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-15711",
    "datePublished": "2026-07-14T19:45:47.784Z",
    "dateReserved": "2026-07-14T09:45:31.488Z",
    "dateUpdated": "2026-09-17T18:39:55.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:68234

CVE-2026-15709 (GCVE-0-2026-15709)

CVE-2026-15711 (GCVE-0-2026-15711)

Tags

Sightings

Nomenclature

Related by attack behaviour