The libsoup library's WebSocket permessage-deflate extension has a flaw in its decompression loop (inflate()) that processes compressed data without enforcing an upper boundary on the output buffer size. Although libsoup limits the incoming compressed frame size, it does not limit memory allocation during decompression. The existing decompressed size check (max_total_message_size) runs only after decompression and is disabled by default for client connections. This allows a remote unauthenticated attacker to send a small, highly compressed payload (a decompression bomb) that triggers unbounded memory allocation, causing an Out-of-Memory crash and Denial of Service. Red Hat has issued a security advisory and update to fix this vulnerability in Red Hat Enterprise Linux 9.

The vulnerability enables remote unauthenticated attackers to cause a Denial of Service by triggering an Out-of-Memory condition through sending specially crafted compressed WebSocket frames. There is no impact on confidentiality or integrity. The CVSS v3.1 base score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

A security update fixing this vulnerability is available from Red Hat for Red Hat Enterprise Linux 9. Users should apply the update as described in Red Hat advisory RHSA-2026:68234. The vendor advisory provides detailed instructions for remediation. No additional mitigation is required once the update is applied.