Skip to main content

GLib CVE-2026-15588

| EUVDEUVD-2026-45939 MEDIUM
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-07-20 secalert@redhat.com GHSA-hrq7-vgh7-p534
Denial Of Service
5.3
CVSS 3.1 · Vendor: redhat
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain low-privilege local account
  2. Delivery
    Connect to target GDBus socket endpoint
  3. Exploit
    Send unbounded data stream during auth handshake
  4. Execution
    Trigger unthrottled memory allocation in gdbusauth
  5. Persist
    Exhaust process memory and CPU
  6. Impact
    Target process crashes or system hangs

Vulnerability Assessment

Weakness
CWE
CWE-770
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires local access to the target system with at least low OS-level privileges (PR:L per CVSS vector), sufficient to open a connection to the GDBus Unix domain socket of the targeted process. The flaw triggers specifically during the gdbusauth pre-authentication phase, meaning no valid D-Bus credentials are needed - only the ability to initiate a socket connection. The description additionally claims 'remote' exploitation is possible, which would apply if the GDBus endpoint is configured to accept TCP connections rather than Unix socket connections; this configuration is non-default for most D-Bus deployments and the CVSS AV:L rating contradicts the 'remote' claim, so TCP-based exposure must be verified by defenders. Exploitation is limited by the requirement for local (or network-reachable) socket access, the need for at least a minimal privilege level to open the connection, and the self-contained scope (S:U) meaning impact is restricted to the targeted process and its host resources rather than propagating across system boundaries.
Impact

The official CVSS 3.1 score of 5.3 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L reflects moderate risk but carries two notable internal inconsistencies that must be flagged. First, the vulnerability description states 'unauthenticated local or remote attacker,' yet the CVSS vector assigns AV:L (Local) and PR:L (Low Privileges) - these signals conflict. AV:L implies the attacker must have local system access, while 'remote' suggests network-reachable exploitation; defenders should verify with Red Hat and upstream GNOME whether TCP-based D-Bus deployments extend the attack surface to AV:N. Second, the official CVSS assigns C:L/I:L alongside the availability impact, which is atypical for a pure resource-exhaustion DoS primitive - the description does not explain a confidentiality or integrity mechanism, and these sub-scores may be overstated. No EPSS data was provided, no POC exploit is identified, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation. Real-world exploitability is constrained to environments where an attacker can access a GDBus socket endpoint with at least low OS privileges, limiting blast radius versus a fully remote, unauthenticated network flaw.
Exploit ScenarioDerived

A local attacker with a low-privileged account connects to a GDBus Unix socket exposed by a system service and, during the authentication handshake handled by gdbusauth, transmits a continuous stream of data in a single authentication line without a newline terminator. The GLib line-reading code buffers the entire stream without a length ceiling, causing the target process's heap to grow unboundedly until the system OOM killer terminates it or CPU exhaustion causes a hang. No public proof-of-concept code has been identified at time of analysis, but the primitive is straightforward to reproduce with a simple socket-writing script.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 20, 2026

Resource exhaustion in GLib's GDBus authentication component allows attackers to crash or hang processes by sending unbounded data streams before authentication completes. The gdbusauth handler reads lines from connecting clients without enforcing any maximum length, meaning an attacker who can reach a GDBus endpoint can force the target process to allocate unbounded memory and saturate CPU cycles. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the unbounded allocation primitive (CWE-770) in a widely-deployed system library warrants attention from Red Hat and GNOME ecosystem consumers.

RemediationAI

No vendor-released patched version has been independently confirmed from the available intelligence; the upstream tracking issue at https://gitlab.gnome.org/GNOME/glib/-/issues/3985 indicates the defect is known to the GNOME project but a tagged release containing the fix has not been identified in the provided data. Defenders should monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15588 and the Red Hat Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2499675 for patch availability. As a compensating control, restrict access to D-Bus sockets using filesystem permissions or SELinux/AppArmor policies to limit which users and processes can initiate GDBus connections, reducing the population of potential initiators; this may affect inter-process communication for legitimate applications and must be tested against workload requirements. If GDBus is configured over TCP (rather than Unix socket), implement host-based firewall rules to restrict that port to trusted source addresses. Additionally, consider deploying system-level memory and CPU resource limits (e.g., via systemd unit MemoryLimit and CPUQuota directives) for processes that expose GDBus endpoints, so that runaway allocation is bounded by the OS before causing a full system hang.

Affected ProductsAI

The affected product is GLib, specifically its GDBus authentication subsystem (gdbusauth). Specific vulnerable version ranges were not enumerated in the provided intelligence data; affected versions must be confirmed via the Red Hat CVE advisory at https://access.redhat.com/security/cve/CVE-2026-15588 and the upstream GNOME GitLab issue at https://gitlab.gnome.org/GNOME/glib/-/issues/3985. Red Hat products shipping GLib (including RHEL and downstream distributions) may be affected; the Red Hat Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2499675 provides further triage detail. Consumers of GLib across other Linux distributions and embedded platforms using GDBus should consult their vendor's security advisories to determine exposure.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GLib is a foundational C library providing core utilities for GNOME and GTK-based applications across Linux and other Unix-like platforms. Its GDBus subsystem implements the D-Bus inter-process communication protocol, and the gdbusauth component specifically governs the authentication handshake that occurs when a client initiates a new D-Bus connection. CWE-770 (Allocation of Resources Without Limits or Throttling) identifies the root cause: the authentication line-reading logic imposes no ceiling on how many bytes it will buffer per line. D-Bus operates primarily over Unix domain sockets (AV:L in CVSS) but can also be configured for TCP transport; the GNOME GitLab issue #3985 tracks this defect upstream. Because the flaw manifests during the pre-authentication phase, even partially privileged local users with access to the socket can trigger it before any credential exchange succeeds. Affected product scope is tracked via the GNOME/glib repository; no CPE string was included in the provided intelligence.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 5.3 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
vuln.today AI 5.5 MEDIUM

Pure resource exhaustion DoS warrants A:H and C:N/I:N; local socket access with low privileges required, consistent with AV:L/PR:L.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.3 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

DescriptionCVE.org

A denial-of-service and resource exhaustion vulnerability exists within the GDBus component of GLib. The gdbusauth authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.

Threat Intelligence Overview

EPSS Score
0.2%
Top 84% exploitable
Prevalence
High
core GNOME/GTK library shipped in most Linux desktop and server distributions
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
Poc
System Exposure· derived
Small
Automatable
No
Human Impact· derived
High
Technical Impact
Partial

Priority Score

26
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +26
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2024-28182 MEDIUM
5.3
CVE-2023-2650 MEDIUM
6.5
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2022-32206 MEDIUM POC
6.5
CVE-2023-24998 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8794-1 ADVISORY https://vuldb.com/vuln/379531 REF https://access.redhat.com/errata/RHSA-2026:39985 REF https://access.redhat.com/errata/RHSA-2026:40485 REF https://access.redhat.com/errata/RHSA-2026:42329 REF https://access.redhat.com/errata/RHSA-2026:55440 REF https://access.redhat.com/errata/RHSA-2026:57015 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:61766 REF https://access.redhat.com/errata/RHSA-2026:61783 REF https://access.redhat.com/errata/RHSA-2026:63135 REF https://access.redhat.com/errata/RHSA-2026:63138 REF https://access.redhat.com/errata/RHSA-2026:63140 REF https://access.redhat.com/errata/RHSA-2026:65762 REF https://access.redhat.com/errata/RHSA-2026:65763 REF https://access.redhat.com/errata/RHSA-2026:65767 REF https://access.redhat.com/errata/RHSA-2026:65768 REF https://access.redhat.com/errata/RHSA-2026:65769 REF https://access.redhat.com/errata/RHSA-2026:65770 REF https://access.redhat.com/errata/RHSA-2026:65771 REF https://access.redhat.com/errata/RHSA-2026:65773 REF https://access.redhat.com/errata/RHSA-2026:66018 REF https://access.redhat.com/errata/RHSA-2026:72394 REF https://access.redhat.com/errata/RHSA-2026:72395 REF https://access.redhat.com/errata/RHSA-2026:72399 REF https://access.redhat.com/errata/RHSA-2026:72470 REF https://access.redhat.com/errata/RHSA-2026:72475 REF https://access.redhat.com/errata/RHSA-2026:72476 REF https://access.redhat.com/errata/RHSA-2026:72502 REF https://access.redhat.com/errata/RHSA-2026:73859 REF https://access.redhat.com/errata/RHSA-2026:73909 REF https://access.redhat.com/errata/RHSA-2026:73929 REF https://access.redhat.com/errata/RHSA-2026:73930 REF https://access.redhat.com/errata/RHSA-2026:73959 REF https://access.redhat.com/errata/RHSA-2026:73960 REF https://access.redhat.com/errata/RHSA-2026:73961 REF https://access.redhat.com/errata/RHSA-2026:73962 REF https://access.redhat.com/errata/RHSA-2026:74458 REF https://access.redhat.com/errata/RHSA-2026:74459 REF https://access.redhat.com/errata/RHSA-2026:74460 REF https://access.redhat.com/errata/RHSA-2026:74461 REF https://access.redhat.com/errata/RHSA-2026:74462 REF https://access.redhat.com/errata/RHSA-2026:74463 REF https://access.redhat.com/errata/RHSA-2026:74674 REF https://access.redhat.com/errata/RHSA-2026:74677 REF https://access.redhat.com/errata/RHSA-2026:74678 REF https://access.redhat.com/errata/RHSA-2026:74679 REF https://access.redhat.com/errata/RHSA-2026:74681 REF https://access.redhat.com/errata/RHSA-2026:74683 REF https://access.redhat.com/errata/RHSA-2026:74685 REF https://access.redhat.com/errata/RHSA-2026:74687 REF https://access.redhat.com/errata/RHSA-2026:74688 REF https://access.redhat.com/errata/RHSA-2026:74771 REF https://access.redhat.com/errata/RHSA-2026:75652 REF https://access.redhat.com/errata/RHSA-2026:75654 REF https://access.redhat.com/errata/RHSA-2026:75655 REF https://access.redhat.com/errata/RHSA-2026:75657 REF https://access.redhat.com/errata/RHSA-2026:75658 REF https://access.redhat.com/errata/RHSA-2026:75659 REF https://access.redhat.com/errata/RHSA-2026:75660 REF https://access.redhat.com/errata/RHSA-2026:76042 REF https://access.redhat.com/errata/RHSA-2026:80769 REF https://access.redhat.com/errata/RHSA-2026:80771 REF https://access.redhat.com/errata/RHSA-2026:82059 REF https://access.redhat.com/errata/RHSA-2026:82061 REF https://access.redhat.com/errata/RHSA-2026:82066 REF https://access.redhat.com/errata/RHSA-2026:82304 REF https://access.redhat.com/errata/RHSA-2026:82322 REF https://access.redhat.com/errata/RHSA-2026:82336 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82368 REF https://access.redhat.com/errata/RHSA-2026:82371 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82415 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:82888 REF https://access.redhat.com/errata/RHSA-2026:92449 REF https://access.redhat.com/errata/RHSA-2026:92452 REF https://access.redhat.com/security/cve/CVE-2026-15588 REF https://bugzilla.redhat.com/show_bug.cgi?id=2499675 REF https://gitlab.gnome.org/GNOME/glib/-/issues/3985

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy