Bug 2499924 (CVE-2026-15711) - CVE-2026-15711 libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation
Summary: CVE-2026-15711 libsoup: SoupWebsocketConnection: libsoup: WebSocket remote de...
Keywords:
Status: NEW
Alias: CVE-2026-15711
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2500546 2500547 2500545
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-14 09:53 UTC by OSIDB Bzimport
Modified: 2026-11-11 11:50 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:68234 0 None None None 2026-09-16 16:53:18 UTC
Red Hat Product Errata RHSA-2026:68235 0 None None None 2026-09-16 16:21:04 UTC
Red Hat Product Errata RHSA-2026:68266 0 None None None 2026-09-16 16:51:30 UTC
Red Hat Product Errata RHSA-2026:68612 0 None None None 2026-09-17 12:31:09 UTC
Red Hat Product Errata RHSA-2026:69108 0 None None None 2026-09-21 02:54:40 UTC
Red Hat Product Errata RHSA-2026:69297 0 None None None 2026-09-21 13:01:06 UTC
Red Hat Product Errata RHSA-2026:69863 0 None None None 2026-09-22 06:05:51 UTC
Red Hat Product Errata RHSA-2026:70598 0 None None None 2026-09-23 07:19:15 UTC
Red Hat Product Errata RHSA-2026:70599 0 None None None 2026-09-23 07:13:08 UTC
Red Hat Product Errata RHSA-2026:71389 0 None None None 2026-09-24 06:49:40 UTC
Red Hat Product Errata RHSA-2026:98453 0 None None None 2026-11-11 11:50:58 UTC
Red Hat Product Errata RHSA-2026:98560 0 None None None 2026-11-11 11:19:20 UTC

Description OSIDB Bzimport 2026-07-14 09:53:23 UTC 
**Vulnerability Reference:**

A flaw in libsoup's WebSocket implementation allows a remote attacker to trigger a denial of service (DoS) by exploiting a protocol validation failure.

**Component / Vulnerable Part:**

`libsoup` -> `libsoup/websocket/soup-websocket-connection.c` (Control frame parser)

**Technical Analysis & Root Cause:**

Per RFC 6455 §5.5, WebSocket control frames (PING, PONG, CLOSE) must not exceed a payload length of 125 bytes and cannot be fragmented. libsoup's frame parsing logic fails to immediately reject non-compliant control frames exceeding this limit. When an oversized control frame is received, the unexpected state disrupts the state machine or triggers an unhandled execution error, forcing the library to abruptly crash.

**Impact:**

A remote, unauthenticated attacker (client or server) can send a single malformed, oversized control frame to instantly terminate the connection wrapper, resulting in a remote denial of service for any application using libsoup WebSockets.
Comment 2 Jon Orris 2026-09-16 16:21:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:68235 https://access.redhat.com/errata/RHSA-2026:68235
Comment 3 Jon Orris 2026-09-16 16:51:29 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:68266 https://access.redhat.com/errata/RHSA-2026:68266
Comment 4 Jon Orris 2026-09-16 16:53:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:68234 https://access.redhat.com/errata/RHSA-2026:68234
Comment 5 Jon Orris 2026-09-17 12:31:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:68612 https://access.redhat.com/errata/RHSA-2026:68612
Comment 6 Jon Orris 2026-09-21 02:54:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:69108 https://access.redhat.com/errata/RHSA-2026:69108
Comment 7 Jon Orris 2026-09-21 13:01:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:69297 https://access.redhat.com/errata/RHSA-2026:69297
Comment 8 Jon Orris 2026-09-22 06:05:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:69863 https://access.redhat.com/errata/RHSA-2026:69863
Comment 9 Jon Orris 2026-09-23 07:13:07 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:70599 https://access.redhat.com/errata/RHSA-2026:70599
Comment 10 Jon Orris 2026-09-23 07:19:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:70598 https://access.redhat.com/errata/RHSA-2026:70598
Comment 11 Jon Orris 2026-09-24 06:49:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:71389 https://access.redhat.com/errata/RHSA-2026:71389
Comment 12 errata-xmlrpc 2026-11-11 11:19:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:98560 https://access.redhat.com/errata/RHSA-2026:98560
Comment 13 errata-xmlrpc 2026-11-11 11:50:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:98453 https://access.redhat.com/errata/RHSA-2026:98453
Note You need to log in before you can comment on or make changes to this bug.