Skip to main content

libsoup EUVDEUVD-2026-44408

| CVE-2026-15709 HIGH
Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)
2026-07-14 redhat GHSA-gv2g-7h3v-q5f3
Denial Of Service Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat
7.5
CVSS 3.1 · Vendor: redhat
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker hosts malicious WebSocket endpoint
  2. Delivery
    libsoup peer negotiates permessage-deflate
  3. Exploit
    Send tiny highly-compressed decompression-bomb frame
  4. Execution
    inflate() expands output with no memory bound
  5. Persist
    Unbounded allocation exhausts RAM
  6. Impact
    Process OOM-killed, denial of service

Vulnerability Assessment

Weakness
CWE
CWE-409
ASVS 5.0
V2 - Validation and Business Logic Compression ratio limits
Exploitation Conditions

Exploitation requires that the vulnerable libsoup peer negotiate the WebSocket permessage-deflate compression extension with the attacker - this is the exact enabling feature. The attack is most reliable against libsoup client connections, where the max_total_message_size decompressed-size guard is disabled by default, so default client configurations are exploitable without special tuning; a peer that has explicitly set a max_total_message_size limit constrains the damage. The limiting factors are therefore that a compressed (permessage-deflate) WebSocket session must be established, and that any non-default max_total_message_size cap reduces or removes exploitability. No authentication (PR:N) and no user interaction (UI:N) are required per the CVSS vector.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a network-reachable, low-complexity, unauthenticated, availability-only impact - no confidentiality or integrity loss, consistent with a pure DoS. No EPSS score, SSVC decision, or KEV entry was provided and no POC is referenced, so exploitation-probability signals are absent rather than confirmed low; likelihood should be treated as unquantified, not benign. The realistic priority is moderate: the attack is technically simple and needs only that a victim libsoup peer negotiate permessage-deflate with an attacker-controlled endpoint, but the impact ceiling is a crash/OOM, not code execution or data exposure. One nuance to verify with the vendor: the description frames the default-off max_total_message_size as a client-side weakness, implying the most common exploitation path is a malicious server attacking a libsoup client that connects to it, even though the CVSS vector is scored as fully network/unauthenticated - the practical prerequisite is establishing a compressed WebSocket session.
Exploit ScenarioDerived

An attacker operates or compromises a WebSocket endpoint and waits for a libsoup-based client (for example a GNOME desktop app or WebKitGTK component) to connect and negotiate permessage-deflate. The attacker then sends a small, highly compressed frame that inflates to gigabytes, and because libsoup does not cap allocation during inflation the process consumes all available memory and is OOM-killed, denying service. No authentication or user interaction beyond the connection is required, and no public exploit code is currently identified.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Denial of service in libsoup's WebSocket permessage-deflate implementation lets a remote, unauthenticated attacker crash applications by sending a small, highly compressed 'decompression bomb' that expands without bound during inflation, exhausting memory and triggering an Out-of-Memory kill. All Red Hat Enterprise Linux 6 through 10 ship the affected libsoup HTTP/WebSocket library, and client connections are especially exposed because the decompressed-size guard (max_total_message_size) is disabled by default for clients. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.

RemediationAI

No vendor-released patched libsoup version was identified in the provided data - the references point to Red Hat's CVE page, Bugzilla 2499922, and GNOME GitLab issue 511 rather than a tagged fixed release, so monitor https://access.redhat.com/security/cve/CVE-2026-15709 and apply the distribution libsoup update as soon as Red Hat publishes fixed package NVRs. As a compensating control until patched, disable or refuse the permessage-deflate WebSocket extension so no compressed frames are inflated (this removes the amplification vector at the cost of losing WebSocket compression bandwidth savings), and where the API allows, set an explicit max_total_message_size on client WebSocket connections rather than relying on the default-disabled value to bound decompressed output (trade-off: legitimate large messages may be rejected). For server-side deployments, front libsoup-based services with a proxy or WAF that can cap WebSocket frame size and per-connection memory, and restrict which peers clients are permitted to connect to.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libsoup is the GNOME project's GObject-based HTTP client/server library used by desktop applications, WebKitGTK, and many Linux services for HTTP and WebSocket communication. The flaw sits in the permessage-deflate WebSocket extension (RFC 7692), which uses zlib inflate() to decompress frames. libsoup bounds the compressed input via max_incoming_payload_size but never tracks or caps the memory allocated as the inflate() loop grows its output buffer chunk-by-chunk. The complementary max_total_message_size check runs only after decompression completes and is turned off by default on client connections, so the amplification is never interrupted mid-inflation. This maps to CWE-409 (Improper Handling of Highly Compressed Data / Data Amplification), the classic 'decompression bomb' root cause where a tiny input yields disproportionately large output.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

A remote unauthenticated peer triggers memory exhaustion with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only OOM DoS, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).

Executive ViewAI

Why It Matters

A denial-of-service vulnerability in libsoup's WebSocket implementation affects all supported versions of Red Hat Enterprise Linux (6-10), allowing unauthenticated remote attackers to crash WebSocket-enabled applications through memory exhaustion via maliciously compressed payloads. No vendor-released patch identified at time of analysis creates urgent availability risk for organizations relying on WebSocket functionality across their RHEL infrastructure.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Implement: strict WebSocket message size validation in application code or reverse proxy (max 1MB default), per-connection rate limiting and connection throttling, network segmentation restricting WebSocket access to internal/trusted networks only, comprehensive logging of decompression failures for early attack detection, and for critical systems consider temporary service redundancy with non-RHEL infrastructure.

Threat Intelligence Overview

EPSS Score
0.5%
Top 58% exploitable
Prevalence
High
core GNOME HTTP/WebSocket library shipped across all RHEL versions
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.5%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-409 – Improper Handling of Highly Compressed Data (Data Amplification)

View all
CVE-2026-77620 HIGH POC
8.7
CVE-2026-59803 HIGH POC
8.7
CVE-2026-53430 HIGH POC
8.7
CVE-2026-49755 HIGH POC
8.2
CVE-2026-48594 HIGH POC
8.2
CVE-2026-59939 HIGH POC
7.5
CVE-2024-7765 HIGH POC
7.5
CVE-2026-22776 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-15709 ADVISORY https://vuldb.com/vuln/378998 REF https://access.redhat.com/errata/RHSA-2026:68234 REF https://access.redhat.com/errata/RHSA-2026:68235 REF https://access.redhat.com/errata/RHSA-2026:68612 REF https://access.redhat.com/errata/RHSA-2026:69108 REF https://access.redhat.com/errata/RHSA-2026:69297 REF https://access.redhat.com/errata/RHSA-2026:69863 REF https://access.redhat.com/errata/RHSA-2026:70598 REF https://access.redhat.com/errata/RHSA-2026:70599 REF https://access.redhat.com/errata/RHSA-2026:71389 REF https://access.redhat.com/security/cve/CVE-2026-15709 REF https://bugzilla.redhat.com/show_bug.cgi?id=2499922 REF https://gitlab.gnome.org/GNOME/libsoup/-/issues/511

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy