libsoup WebSocket Decompression Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in libsoup's WebSocket implementation, specifically when the permessage-deflate extension is used. The issue arises because the decompression loop in the extension processes data in chunks without enforcing a maximum limit on the output buffer size. Although libsoup restricts the size of incoming compressed frames, it does not monitor or limit memory allocation during decompression. This flaw allows a remote, unauthenticated attacker to send a small, highly compressed payload that decompresses to a much larger size, causing unbounded memory allocation. The resulting memory exhaustion leads to an out-of-memory crash, disrupting service.

Impact

Exploitation of this vulnerability causes applications or services to crash after running out of memory. This can severely disrupt any active WebSocket connections, whether on the client or server side.

Reproduction

The vulnerability can be reproduced by creating a WebSocket server that sends a small, highly compressed payload (a decompression bomb) to a client application using libsoup with the permessage-deflate extension enabled. The server can be set up to send the compressed payload, which will then be decompressed by the client, causing an out-of-memory crash. This issue can also be reproduced on the server side by having a malicious client send a decompression bomb to a libsoup WebSocket server.