CVE-2026-15588

MEDIUM

Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering

Title source: cna
STIX 2.1

Description

A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.

References (6)

Core 6
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:39985
https://access.redhat.com/errata/RHSA-2026:39985
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:40485
https://access.redhat.com/errata/RHSA-2026:40485
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:42329
https://access.redhat.com/errata/RHSA-2026:42329
Vdb Entry, X_Refsource_Redhat vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2026-15588
Issue Tracking, X_Refsource_Redhat issue-tracking x_refsource_redhat
RHBZ#2499675
https://bugzilla.redhat.com/show_bug.cgi?id=2499675

Scores

CVSS v3 5.3
EPSS 0.0019
EPSS Percentile 9.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-770
Status published
Products (10)
Red Hat/Red Hat Enterprise Linux 10
Red Hat/Red Hat Enterprise Linux 6
Red Hat/Red Hat Enterprise Linux 7
Red Hat/Red Hat Enterprise Linux 8
Red Hat/Red Hat Enterprise Linux 9
Red Hat/Red Hat Hardened Images
Red Hat/Red Hat Hardened Images 2.89.1-1.1.hum1
Red Hat/Red Hat Hardened Images 2.89.1-1.2.hum1
Red Hat/Red Hat Hardened Images 2.89.2-2.hum1
Red Hat/Red Hat OpenShift Container Platform 4
Published Jul 20, 2026
Tracked Since Jul 20, 2026