CVE-2026-15711: libsoup WebSocket DoS Vulnerability

CVE-2026-15711 Overview

A denial of service vulnerability exists in the WebSocket frame parsing implementation of libsoup, the GNOME HTTP client/server library. The parser fails to enforce the RFC 6455 §5.5 requirement that all WebSocket control frames (PING, PONG, CLOSE) carry a payload of 125 bytes or less. A remote, unauthenticated attacker can send an oversized control frame to trigger an internal processing crash instead of a clean connection termination. Applications built on libsoup WebSockets become unavailable to legitimate clients as a result. The weakness is classified as [CWE-770] (Allocation of Resources Without Limits or Throttling).

Critical Impact
Any network-reachable application using libsoup for WebSocket communication can be crashed by an unauthenticated attacker with a single malformed control frame.

Affected Products

GNOME libsoup — WebSocket frame parsing component
Red Hat Enterprise Linux distributions shipping vulnerable libsoup builds
Downstream applications and desktop components linking against libsoup for WebSocket transport

Discovery Timeline

2026-07-14 - CVE-2026-15711 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15711

Vulnerability Analysis

The defect resides in how libsoup processes inbound WebSocket control frames. RFC 6455 §5.5 states that control frames must not exceed 125 bytes of payload and must not be fragmented. A compliant implementation rejects any oversized control frame and closes the connection with a protocol error.

libsoup does not perform this validation before entering downstream frame handling. When an attacker delivers a control frame with a payload larger than 125 bytes, the parser reaches an inconsistent internal state and crashes the process handling the connection. The failure mode is a remote denial of service against every application that shares that process.

The attack requires no authentication and no user interaction. It reaches the parser over the network as soon as a WebSocket handshake completes, so any service exposing a libsoup-backed WebSocket endpoint is reachable.

Root Cause

The root cause is missing input validation on the WebSocket frame length field for control opcodes. The parser trusts the length declared in the frame header without checking it against the 125-byte cap mandated by the specification. This maps to [CWE-770], where a resource is consumed without an enforced bound. Instead of emitting a protocol error and terminating the connection, libsoup proceeds through code paths that assume length invariants that no longer hold.

Attack Vector

Exploitation is straightforward. An attacker completes a normal WebSocket handshake against a vulnerable server or connects a malicious server to a vulnerable client. The attacker then sends a single control frame — for example, a PING with a payload greater than 125 bytes — over the established WebSocket channel. The receiving libsoup process crashes, terminating service for all connected users. Because the trigger is a single frame, the attack is trivial to script and repeat, sustaining an outage as long as the service is restarted.

No verified public proof-of-concept is available. See the GNOME libsoup Issue #515 and Red Hat Bug Report #2499924 for upstream technical discussion.

Detection Methods for CVE-2026-15711

Indicators of Compromise

Unexpected process termination or crash signals in services that link against libsoup and handle WebSocket traffic
Repeated abnormal WebSocket disconnects following a small number of frames from a single remote peer
Core dumps or systemd service restart events correlated with inbound WebSocket sessions

Detection Strategies

Inspect WebSocket traffic for control frames (opcodes 0x8, 0x9, 0xA) whose payload length exceeds 125 bytes and alert on any match
Correlate application crash telemetry with active WebSocket sessions to identify parser-triggered failures
Deploy protocol-aware intrusion detection signatures that flag RFC 6455 §5.5 violations at the network edge

Monitoring Recommendations

Track service restart frequency and mean time between failures for any daemon consuming libsoup WebSockets
Log source IP addresses of peers that trigger WebSocket protocol errors and rate-limit repeat offenders
Aggregate crash reports and journal entries centrally to identify patterns consistent with remote DoS attempts

How to Mitigate CVE-2026-15711

Immediate Actions Required

Inventory all systems and applications that link against libsoup and expose WebSocket endpoints to untrusted networks
Apply distribution-provided libsoup updates as soon as they are published by your vendor
Restrict network exposure of vulnerable WebSocket services to trusted clients until patches are deployed

Patch Information

Refer to the Red Hat CVE-2026-15711 advisory for the authoritative list of fixed package versions per Red Hat product. Track the upstream fix through GNOME libsoup Issue #515. Other Linux distributions ship their own rebuilds — consult the corresponding vendor security tracker before deploying.

Workarounds

Place a WebSocket-aware reverse proxy in front of libsoup-backed services and configure it to reject control frames larger than 125 bytes
Terminate TLS and WebSocket sessions at a hardened front-end (for example, a proxy known to enforce RFC 6455) and forward only validated traffic to the application
Disable WebSocket functionality in affected applications where the feature is not required

bash

# Example: block oversized WebSocket control frames at an nginx reverse proxy
# by capping client_max_body_size and enforcing proxy_read_timeout, then
# fronting the service with a WAF module that validates RFC 6455 frame rules.
http {
    client_max_body_size 16k;
    proxy_read_timeout   30s;

    server {
        listen 443 ssl;
        location /ws {
            proxy_pass http://libsoup_backend;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            # Deploy a WebSocket-aware WAF module in front of this location
            # to drop control frames whose payload exceeds 125 bytes.
        }
    }
}