Skip to main content

libsoup CVE-2026-15711

| EUVDEUVD-2026-44428 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-07-14 redhat GHSA-w948-qrw5-cffc
Denial Of Service Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat
7.5
CVSS 3.1 · Vendor: redhat
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach libsoup WebSocket endpoint
  2. Delivery
    Establish WebSocket session
  3. Exploit
    Send oversized control frame (>125 bytes)
  4. Execution
    Parser mishandles RFC 6455 violation
  5. Persist
    Internal processing crash
  6. Impact
    Denial of service

Vulnerability Assessment

Weakness
CWE
CWE-770
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the target application actually uses libsoup's WebSocket support and that the attacker can reach an active WebSocket connection endpoint - for a server, an exposed WebSocket-terminating service; for a client, the victim application must be induced to open a WebSocket connection to an attacker-controlled server. The concrete trigger is a WebSocket control frame (PING, PONG, or CLOSE) carrying a payload greater than 125 bytes, violating RFC 6455 §5.5. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed once a WebSocket session exists, and default configurations are affected wherever libsoup WebSockets are in use. The principal limiting factors are that libsoup WebSocket functionality must be in use (applications not using WebSockets are unaffected), the attacker must have a network path to a WebSocket session, and impact is confined to a crash/DoS with no code execution or data exposure.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent and credible: the attack is network-reachable, low-complexity, requires no privileges (PR:N, so unauthenticated) and no user interaction, with impact confined entirely to availability - no confidentiality or integrity loss. This is a pure availability/DoS bug, not an RCE, which caps its severity at HIGH rather than CRITICAL. No EPSS score, KEV listing, POC, or SSVC decision was supplied, so exploitation likelihood cannot be quantified from the input; the absence of these signals means this should be triaged as a real-but-bounded reliability risk rather than an emergency. The practical risk is highest for internet-facing services that terminate WebSocket connections via libsoup; for typical desktop client usage the attacker must first induce the victim to connect to a malicious WebSocket endpoint, which raises the real-world bar above the raw vector.
Exploit ScenarioDerived

An attacker who can reach a libsoup-backed WebSocket endpoint - or who lures a libsoup-based client (such as a WebKitGTK application) into connecting to an attacker-controlled server - establishes a WebSocket session and sends a single PING, PONG, or CLOSE control frame with a payload larger than 125 bytes. libsoup mishandles the protocol violation and crashes the hosting process, denying service to all users of that application. No authentication, user interaction beyond the connection, or special privileges are required (AV:N/AC:L/PR:N/UI:N); no public exploit code is identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Remote denial of service in libsoup, the GNOME HTTP client/server library, allows unauthenticated attackers to crash any application using libsoup's WebSocket support by sending a single malformed control frame. The parser fails to enforce RFC 6455's 125-byte limit on PING/PONG/CLOSE control frames and mishandles the oversized payload instead of cleanly closing the connection, causing an internal processing crash. Red Hat reports the flaw across RHEL 6 through 10; no public exploit has been identified at time of analysis and no EPSS score was provided.

RemediationAI

Released patched version not independently confirmed from the provided data - an upstream tracking issue exists (https://gitlab.gnome.org/GNOME/libsoup/-/issues/515) but no exact fixed libsoup version or tagged release is cited. Monitor and apply the Red Hat security update when published (https://access.redhat.com/security/cve/CVE-2026-15711) and the corresponding upstream libsoup release, then restart or update all applications and services linked against libsoup so they pick up the patched library. As a compensating control until a patch is applied, restrict exposure of any internet-facing service that terminates WebSocket connections through libsoup - for example, front it with a reverse proxy or WAF that enforces RFC 6455 control-frame length limits and drops control frames exceeding 125 bytes, which removes the malicious input before it reaches libsoup at the cost of adding a proxy hop. If WebSocket functionality is not required by a given deployment, disabling it eliminates the attack surface entirely but breaks any feature depending on it. Because impact is limited to availability, ensure affected services have automatic restart/supervision (e.g. systemd Restart=on-failure) to reduce downtime from crash attempts, accepting that this mitigates rather than prevents the DoS.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libsoup is the HTTP and WebSocket library underpinning much of the GNOME stack (WebKitGTK, Epiphany, and numerous GLib/GTK applications and services). The defect lives in its WebSocket frame parser: RFC 6455 §5.5 mandates that all control frames (PING, PONG, CLOSE) carry a payload of 125 bytes or fewer, and a compliant implementation must fail the connection immediately on violation. libsoup instead accepts the non-compliant oversized control frame and processes it improperly, leading to a crash. The root cause maps to CWE-770 (Allocation of Resources Without Limits or Throttling) - the parser does not enforce the protocol-mandated bound before acting on the frame, so a violation that should terminate the connection instead drives the process into an unrecoverable state.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Remote unauthenticated attacker sends one malformed frame with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is a crash affecting only availability (A:H, C:N/I:N), scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets.

Executive ViewAI

Why It Matters

CVE-2026-15711 in libsoup enables attackers to crash applications across your RHEL infrastructure (versions 6-10) using WebSocket functionality with a single malformed network packet, causing immediate availability impact to web services, APIs, and real-time platforms. No public exploit identified at time of analysis, but the low attack complexity and broad affected surface create substantial business continuity risk. Critical action required: inventory affected applications and deploy interim compensating controls, as no vendor patch is available.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: deploy WAF rules to validate and reject WebSocket control frames exceeding 125-byte RFC 6455 limits; restrict WebSocket traffic through network segmentation to trusted sources where feasible; enable comprehensive logging of WebSocket connection failures and anomalies; configure automatic service restart mechanisms to minimize outage duration; maintain active monitoring of vendor and upstream security advisory channels for patch availability and release timelines.

Threat Intelligence Overview

EPSS Score
0.4%
Top 65% exploitable
Prevalence
High
core GNOME HTTP/WebSocket library shipped across major Linux distributions
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.4%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2024-28182 MEDIUM
5.3
CVE-2023-2650 MEDIUM
6.5
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2022-32206 MEDIUM POC
6.5
CVE-2023-24998 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-15711 ADVISORY https://vuldb.com/vuln/379182 REF https://access.redhat.com/errata/RHSA-2026:68234 REF https://access.redhat.com/errata/RHSA-2026:68235 REF https://access.redhat.com/errata/RHSA-2026:68266 REF https://access.redhat.com/errata/RHSA-2026:68612 REF https://access.redhat.com/errata/RHSA-2026:69108 REF https://access.redhat.com/errata/RHSA-2026:69297 REF https://access.redhat.com/errata/RHSA-2026:69863 REF https://access.redhat.com/errata/RHSA-2026:70598 REF https://access.redhat.com/errata/RHSA-2026:70599 REF https://access.redhat.com/errata/RHSA-2026:71389 REF https://access.redhat.com/security/cve/CVE-2026-15711 REF https://bugzilla.redhat.com/show_bug.cgi?id=2499924 REF https://gitlab.gnome.org/GNOME/libsoup/-/issues/515

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy