Executive brief
libsoup, a widely used HTTP client/server library for GNOME and GTK applications, is vulnerable to a 'decompression bomb' attack. An attacker can send a small, specially crafted compressed message that expands to a massive size when processed, exhausting the system's memory. This results in the affected application crashing, leading to a denial of service for users of web browsers like Epiphany or other desktop applications that rely on this library for WebSocket communications.
Technical details
A vulnerability exists in libsoup's WebSocket permessage-deflate extension due to improper handling of highly compressed data (CWE-409). The decompression loop in `soup-websocket-extension-deflate.c` uses `inflate()` to process data in chunks and dynamically grows a `GByteArray` buffer without enforcing an upper bound during the process. While `max_incoming_payload_size` limits the compressed size on the wire, the check for decompressed size (`max_total_message_size`) occurs only after decompression is complete. Furthermore, `max_total_message_size` defaults to unlimited for client connections. An unauthenticated remote attacker can send a small compressed frame (e.g., <128KB) that expands to hundreds of megabytes, triggering an Out-of-Memory (OOM) crash before the library can reject the message.
Affected products
- GNOME libsoup 3.2.3, 3.7.0
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
Timeline
- 2026-07-14: disclosed: Vulnerability reported via Red Hat and GNOME GitLab
- 2026-07-14: advisory: CVE-2026-15709 published