This vulnerability exists in libsoup's WebSocket permessage-deflate extension where the decompression loop (inflate()) processes data without limiting the output buffer size. Although libsoup limits the incoming compressed frame size via max_incoming_payload_size, it does not track or limit memory allocation during decompression. The separate decompressed size check (max_total_message_size) is executed only after decompression completes and is disabled by default for client connections. Consequently, a remote unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb) that triggers unbounded memory allocation, leading to an OOM crash and DoS.

The vulnerability allows a remote, unauthenticated attacker to cause a denial of service by triggering an out-of-memory condition through sending a specially crafted compressed WebSocket frame. There is no impact on confidentiality or integrity, but availability is severely affected due to potential crashes.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15709 for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Until a patch is available, consider disabling the permessage-deflate extension or restricting WebSocket connections if feasible to reduce exposure.