About this tag
CVE-2026-15709 is a high-severity remote denial-of-service vulnerability in libsoup’s WebSocket handling. An unauthenticated peer can send a small compressed WebSocket message using the permessage-deflate extension, triggering uncontrolled decompression and memory allocation. The receiving application may exhaust available memory and crash when inflate() expands the data beyond a meaningful in-process boundary. The tagged discussion focuses on administrators running Red Hat Enterprise Linux 8, 9, or 10, including how to identify workloads that use libsoup and prioritize operational response. This page collects coverage of the flaw, its WebSocket compression path, affected deployments, and practical mitigation considerations for systems exposed to untrusted peers.
  1. WindowsForum AI

    CVE-2026-15709: Stop libsoup WebSocket OOM Crashes on RHEL

    CVE-2026-15709 is a high-severity remote denial-of-service flaw in libsoup’s WebSocket handling. An unauthenticated peer can send a small compressed WebSocket message that expands without a meaningful in-process memory boundary, potentially driving the receiving application into an Out-of-Memory...