Threats Tagged 'cve-2026-15711'

A moderate severity vulnerability (CVE-2026-15711) exists in the libsoup library used by GNOME, where an oversized control frame in the WebSocket implementation can cause a remote denial of service. Red Hat has issued a security advisory and released updates for Red Hat Enterprise Linux 8 to address this issue.

Two security vulnerabilities have been identified in the libsoup HTTP client and server library for GNOME, affecting Red Hat Enterprise Linux 9. These include a remote denial of service caused by unbounded decompression in the WebSocket permessage-deflate extension (CVE-2026-15709) and a remote denial of service via an oversized control frame protocol violation in WebSocket connections (CVE-2026-15711). Red Hat has released security updates addressing these issues with a moderate severity rating.

Multiple security vulnerabilities have been identified in libsoup3, an HTTP library used in GNOME applications. These include a remote denial of service via unbounded decompression in the WebSocket permessage-deflate extension, a remote denial of service caused by oversized control frame protocol violations in WebSocket connections, and a heap use-after-free vulnerability in the HTTP/2 client triggered by a GOAWAY frame during body upload. Red Hat has released security updates addressing these issues in Red Hat Enterprise Linux 10 and related products.

A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets.

A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets.