A flaw in libsoup’s WebSocket frame parser allows a remote attacker to send a control frame with a payload larger than the 125‑byte limit defined by RFC 6455. Because the parser does not enforce this restriction, it does not terminate the connection and instead crashes internally, causing the application that uses libsoup WebSockets to stop responding. The effect is a denial of service that can be triggered without authentication from any network source that can reach the WebSocket endpoint.

The vulnerability affects all Red Hat Enterprise Linux operating systems from version 6 through 10, which ship libraries that include the unpatched libsoup implementation. The issue applies to any application on those systems that utilizes libsoup for WebSocket communication.

The CV 7.5 indicates a high severity of the impact. The EPSS score is below 1 %, suggesting that the probability of exploitation is low at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote, unauthenticated network user sending an oversized control frame to an exposed WebSocket service. If successful, the service will crash, denying legitimate users access until the process is restarted.