This vulnerability exists in libsoup's WebSocket implementation when using the permessage-deflate extension. The decompression loop (inflate()) processes data without enforcing an upper limit on the output buffer size, allowing a remote unauthenticated attacker to send a small, highly compressed payload (a decompression bomb) that triggers unbounded memory allocation. Although libsoup limits the incoming compressed frame size via max_incoming_payload_size, it does not track memory allocation during decompression. A separate decompressed size check (max_total_message_size) exists but is executed only after decompression and is disabled by default for client connections. This results in an Out-of-Memory crash and Denial of Service.

A remote unauthenticated attacker can exploit this vulnerability by sending a crafted small compressed payload that causes unbounded memory allocation during decompression. This leads to an Out-of-Memory (OOM) condition and crashes the affected service, resulting in Denial of Service (DoS). There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-15709 for current remediation guidance. No official fix or temporary workaround is stated in the provided advisory content. Until a patch is available, consider disabling the permessage-deflate extension or limiting WebSocket connections from untrusted sources if feasible.