CVE-2026-15711: Allocation of Resources Without Limits or Throttling in Red Hat Red Hat Enterprise Linux 10

The vulnerability exists in libsoup's WebSocket frame parsing implementation where it fails to enforce the maximum payload length of 125 bytes for control frames as mandated by RFC 6455 §5.5. When a remote, unauthenticated attacker sends a non-compliant oversized control frame, the parser does not terminate the connection immediately as required but instead crashes during internal processing. This leads to a remote denial of service condition affecting applications that utilize libsoup WebSockets on Red Hat Enterprise Linux 10.

This vulnerability allows a remote unauthenticated attacker to cause a denial of service by crashing the WebSocket parser in libsoup. There is no impact on confidentiality or integrity, but availability is affected due to application crashes triggered by malformed WebSocket control frames.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-15711 for current remediation guidance. No official fix or temporary workaround is stated in the provided information. Until a patch is available, consider limiting exposure of vulnerable WebSocket services to untrusted networks if possible.