CVE catalog

CVE-2026-15709

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper b

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.88% · Oct 25, 2026

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibsoup3sid3.8.0-3fixed
Debianlibsoup3forky3.8.0-3fixed
Debianlibsoup3trixie3.6.5-3vulnerable
Debianlibsoup3bookworm3.2.3-0+deb12u2vulnerable
Debianlibsoup2.4trixie2.74.3-10.1vulnerable
Debianlibsoup2.4bookworm2.74.3-1+deb12u1vulnerable
Ubuntulibsoup2.4pro2.74.3-10.1ubuntu4vulnerable
Ubuntulibsoup2.4pro2.74.3-10.1ubuntu5vulnerable
Ubuntulibsoup2.4pro2.74.3-10.1ubuntu5+esm1vulnerable
Ubuntulibsoup2.4pro2.74.3-10.1ubuntu5+esm2vulnerable
Ubuntulibsoup2.4pro2.74.3-10.1ubuntu5+esm3vulnerable
Ubuntulibsoup2.422.042.72.0-3ubuntu3vulnerable
Ubuntulibsoup2.422.042.74.1-1vulnerable
Ubuntulibsoup2.422.042.74.2-2vulnerable
Ubuntulibsoup2.422.042.74.2-3vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.1vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.2vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.3vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.4vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.5vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.6vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.7vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.8vulnerable
Ubuntulibsoup2.422.042.74.2-3ubuntu0.9vulnerable
Ubuntulibsoup3pro3.0.4-2vulnerable
Ubuntulibsoup3pro3.0.4-3vulnerable
Ubuntulibsoup3pro3.0.5-1vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm1vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm2vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm3vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm4vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm5vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm6vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm7vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm8vulnerable
Ubuntulibsoup3pro3.0.7-0ubuntu1+esm9vulnerable
Ubuntulibsoup2.424.042.74.3-1vulnerable
Ubuntulibsoup2.424.042.74.3-2vulnerable
Ubuntulibsoup2.424.042.74.3-3vulnerable
Ubuntulibsoup2.424.042.74.3-6vulnerable
Ubuntulibsoup2.424.042.74.3-6build1vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.1vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.2vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.3vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.4vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.5vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.6vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.7vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.8vulnerable
Ubuntulibsoup2.424.042.74.3-6ubuntu1.9vulnerable
Ubuntulibsoup324.043.4.2-4vulnerable
Ubuntulibsoup324.043.4.4-1vulnerable
Ubuntulibsoup324.043.4.4-2vulnerable
Ubuntulibsoup324.043.4.4-4vulnerable
Ubuntulibsoup324.043.4.4-5vulnerable
Ubuntulibsoup324.043.4.4-5build1vulnerable
Ubuntulibsoup324.043.4.4-5build2vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.1vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.2vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.3vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.4vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.5vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.6vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.7vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.8vulnerable
Ubuntulibsoup324.043.4.4-5ubuntu0.9vulnerable
Ubuntulibsoup2.426.102.74.3-10.1ubuntu5vulnerable
Ubuntulibsoup326.103.6.6-1vulnerable
Ubuntulibsoup326.103.6.6-1ubuntu3vulnerable
Ubuntulibsoup326.043.6.5-4vulnerable
Ubuntulibsoup326.043.6.5-5vulnerable
Ubuntulibsoup326.043.6.5-6vulnerable
Ubuntulibsoup326.043.6.5-7vulnerable
Ubuntulibsoup326.043.6.5-9vulnerable
Ubuntulibsoup326.043.6.6-1vulnerable
Ubuntulibsoup326.043.6.6-1ubuntu0.1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibsoup3sourcesid3.8.0-1not yet assignedNot reported[1142839]
Debianlibsoup3sourceforky3.8.0-1not yet assignedNot reported[1142839]
Debianlibsoup3sourcetrixie(unfixed)not yet assignedNot reported[1142839]
Debianlibsoup3sourcebookworm(unfixed)not yet assignedNot reported[1142839]
Debianlibsoup2.4sourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianlibsoup2.4sourcebookworm(unfixed)not yet assignedNot reportedNot reported

[Debian bug #1142839]

Notes

[trixie] libsoup3: Minor issue [bookworm] libsoup3: Limited support [trixie] libsoup2.4: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [gir1.2-soup-2.4]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [gir1.2-soup-3.0]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup2.4-1]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup2.4-common]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup2.4-dev]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup2.4-doc]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · all · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup2.4-tests]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup-3.0-0]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-common]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-dev]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-doc]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · all · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-3.0-tests]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.2.3-0+deb12u2 · amd64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

    • 3.2.3-0+deb12u2 · arm64 · bookworm

      Affected

      nvd · libsoup3 · debian · bookworm; nvd · libsoup3 · debian · 12

  • [libsoup-gnome2.4-1]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

  • [libsoup-gnome2.4-dev]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

    • 2.74.3-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libsoup2.4 · debian · bookworm; nvd · libsoup2.4 · debian · 12

[Debian 13 (Trixie)]

  • [gir1.2-soup-2.4]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · amd64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

  • [gir1.2-soup-3.0]Affected

    Source package: [libsoup3]

    Details (2)

    • 3.6.5-3 · amd64 · trixie

      Affected

      nvd · libsoup3 · debian · 13

    • 3.6.5-3 · arm64 · trixie

      Affected

      nvd · libsoup3 · debian · 13

  • [libsoup-2.4-1]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · amd64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

  • [libsoup2.4-common]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · all · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · all · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

  • [libsoup2.4-dev]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · amd64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · arm64 · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

  • [libsoup2.4-doc]Affected

    Source package: [libsoup2.4]

    Details (2)

    • 2.74.3-10.1 · all · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

    • 2.74.3-10.1 · all · trixie

      Affected

      nvd · libsoup2.4 · debian · 13

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]