Hi,

The following vulnerability was published for libsoup3.

CVE-2026-15709[0]:
| A flaw was found in libsoup's WebSocket implementation when using
| the permessage-deflate extension. The extension's decompression loop
| (inflate()) processes data in chunks without enforcing an upper
| boundary limit on the output buffer size. While libsoup limits the
| incoming compressed frame size via max_incoming_payload_size, it
| fails to track or limit memory allocation during decompression. A
| separate check for decompressed size (max_total_message_size) exists
| but executes only after inflation is complete, and it is entirely
| disabled by default for client connections. A remote,
| unauthenticated attacker can exploit this by sending a small, highly
| compressed payload (a decompression bomb), causing unbounded memory
| allocation that triggers an Out-of-Memory (OOM) crash and a Denial
| of Service (DoS).


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-15709
https://www.cve.org/CVERecord?id=CVE-2026-15709
[1] https://gitlab.gnome.org/GNOME/libsoup/-/issues/511

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore