Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
libsoup can be crashed by crafted WebSocket traffic
published 1 month ago
Summary
The libsoup library used for HTTP and WebSocket communication in GNOME can be forced to stop working when it receives specially crafted WebSocket messages. An attacker who can send such messages could make services that rely on libsoup unavailable. Install the latest libsoup update from Rocky Linux to protect your systems.
What to do
- Update rocky libsoup to version 0:2.72.0-16.el9_8.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:9 | rocky | libsoup |
< 0:2.72.0-16.el9_8.3 Fix: upgrade to 0:2.72.0-16.el9_8.3
|
Original advisory text
Moderate: libsoup security update
The libsoup packages provide an HTTP client and server library for GNOME.
Security Fix(es):
* SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service (CVE-2026-15709)
* libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation (CVE-2026-15711)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service (CVE-2026-15709)
* libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation (CVE-2026-15711)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:68234 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2499922 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2499924 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:68234 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published17 Sep 2026
Updated17 Sep 2026
First seen17 Sep 2026
Sources
RLSA-2026:68234 · OSV
Track software like this
Free during beta