CVE-2026-15709
Last modified
CVE-2026-15709 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. EPSS estimates a 0.55% chance of exploitation in the next 30 days.
Description
A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | All versions |
| Red Hat | Red Hat Enterprise Linux 6 | All versions |
| Red Hat | Red Hat Enterprise Linux 7 | All versions |
| Red Hat | Red Hat Enterprise Linux 8 | All versions |
| Red Hat | Red Hat Enterprise Linux 9 | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-15709?
How severe is CVE-2026-15709?
How do I fix CVE-2026-15709?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-1570The Simple Bible Verse via Shortcode plugin for WordPress is…6.4
- CVE-2026-15700A security flaw has been discovered in DedeCMS 5.7.118. Affe…4.7
- CVE-2026-15701A weakness has been identified in Totolink NR1800X 9.1.0u.62…9.8
- CVE-2026-15702A security vulnerability has been detected in tamagui up to …6.3
- CVE-2026-15703A vulnerability was detected in SourceCodester Simple and Ni…7.3
- CVE-2026-15704In Eclipse BaSyx Go Components versions up to and including …9.8
- CVE-2026-1571User-controlled input is reflected into the HTML output with…6.1
- CVE-2026-15711A vulnerability was found in libsoup's WebSocket frame parsi…7.5
- CVE-2026-15712A heap buffer over-read vulnerability was discovered in libs…5.9
- CVE-2026-15713A vulnerability was found in libsoup's HTTP/2 protocol imple…5.9
- CVE-2026-15714An out-of-bounds read vulnerability was found in libsoup's m…6.5
- CVE-2026-15715A vulnerability was identified in SourceCodester Class and E…4.3
Are you affected by CVE-2026-15709?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST