Threats Tagged 'cve-2026-15709'

Multiple vulnerabilities have been identified in libsoup, an HTTP client/server library for GNOME. These include an unbounded decompression memory allocation flaw in the WebSocket permessage-deflate extension (CVE-2026-15709), a memory leak in the HTTP/2 implementation leading to denial of service (CVE-2026-15713), an out-of-bounds read in multipart processing (CVE-2026-15714), a CRLF injection issue (CVE-2026-3633), and proxy credential leakage after CONNECT tunnel establishment (CVE-2026-66339). These vulnerabilities can lead to denial of service or information disclosure. A security update addressing these issues is available.

Two security vulnerabilities have been identified in the libsoup HTTP client and server library for GNOME, affecting Red Hat Enterprise Linux 9. These include a remote denial of service caused by unbounded decompression in the WebSocket permessage-deflate extension (CVE-2026-15709) and a remote denial of service via an oversized control frame protocol violation in WebSocket connections (CVE-2026-15711). Red Hat has released security updates addressing these issues with a moderate severity rating.

Multiple security vulnerabilities have been identified in libsoup3, an HTTP library used in GNOME applications. These include a remote denial of service via unbounded decompression in the WebSocket permessage-deflate extension, a remote denial of service caused by oversized control frame protocol violations in WebSocket connections, and a heap use-after-free vulnerability in the HTTP/2 client triggered by a GOAWAY frame during body upload. Red Hat has released security updates addressing these issues in Red Hat Enterprise Linux 10 and related products.

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).