A flaw in libsoup’s `permessage-deflate` WebSocket extension allows a remote attacker to cause a Denial of Service via memory exhaustion. The internal `inflate()` loop resizes its buffer dynamically without enforcing an upper limit *during* decompression. Because size checks are either performed only on the compressed wire-payload or executed too late (after inflation completes), a small decompression bomb can trigger an immediate Out-of-Memory (OOM) crash on both client and server applications.