Skip to main content

GLib CVE-2026-58015

| EUVDEUVD-2026-40318 HIGH
Path Traversal (CWE-22)
2026-06-30 secalert@redhat.com GHSA-hmpf-72wc-2r6x
Path Traversal Information Disclosure Glib Enterprise Linux
7.5
CVSS 3.1 · NVD
Share

Severity by source

Vendor (redhat) PRIMARY
MEDIUM
qualitative
NVD
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
6.5 MEDIUM

Network-reachable via TCP D-Bus and low complexity, but the victim client must be induced to connect to the malicious server (UI:R); only confidentiality is impacted (C:H, I:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

7
Analysis Updated
Jul 01, 2026 - 18:14 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 01, 2026 - 18:14 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 01, 2026 - 18:07 vuln.today
cvss_changed
Severity Changed
Jul 01, 2026 - 18:07 NVD
MEDIUM HIGH
CVSS changed
Jul 01, 2026 - 18:07 NVD
5.9 (MEDIUM) 7.5 (HIGH)
Patch available
Jun 30, 2026 - 16:01 EUVD
Analysis Generated
Jun 30, 2026 - 13:36 vuln.today

DescriptionNVD

A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.

AnalysisAI

Arbitrary file disclosure in GLib's GDBus client affects the DBUS_COOKIE_SHA1 SASL authentication mechanism, where the client fails to validate the server-supplied cookie_context parameter. A malicious or compromised D-Bus server can send a cookie_context containing path traversal sequences, forcing the client to read attacker-chosen files and leak their contents by confirming guessed values against the returned authentication hash. No public exploit has been identified and it is not in CISA KEV; EPSS is low at 0.30% (22th percentile), consistent with the SSVC assessment of no known exploitation.

Technical ContextAI

GLib (GObject/GLib, the GNOME core utility library) implements D-Bus via its GDBus stack, including the SASL authentication handshake used when a client connects to a bus or peer. The DBUS_COOKIE_SHA1 mechanism authenticates by having both sides read a shared secret from a cookie file located under a directory identified by the cookie_context token, then exchanging SHA1 hashes computed over that secret plus challenge data. The root cause is a path-traversal / improper-input-validation class weakness (aligned with CWE-22, though the input lists CWE as N/A): the client trusts the cookie_context value from the server and uses it to build a filesystem path without sanitizing '../' sequences, so the server can point the client at arbitrary files. Affected CPEs are cpe:2.3:a:gnome:glib and Red Hat Enterprise Linux 6 through 10 (cpe:2.3:o:redhat:enterprise_linux), reflecting GLib's role as a base OS component.

RemediationAI

Vendor-released patch: upgrade GLib to 2.88.1 or later, which adds validation of the cookie_context parameter; on Red Hat Enterprise Linux 6-10, apply the distribution's updated glib2 package once published and track status via https://access.redhat.com/security/cve/CVE-2026-58015 and the upstream fix at https://gitlab.gnome.org/GNOME/glib/-/issues/3931. Until patched, the most effective compensating control is to avoid initiating GDBus client connections to untrusted or remote D-Bus servers and to prefer local Unix-domain-socket transports (which use EXTERNAL auth rather than DBUS_COOKIE_SHA1), disabling or blocking TCP D-Bus listeners (default port range) at the host/network level; the trade-off is that legitimate remote or cross-machine D-Bus integrations relying on cookie authentication will break. Restricting which processes may reach external bus endpoints and monitoring for unexpected outbound D-Bus connections further limits exposure.

More in Glib

View all
CVE-2024-52533 CRITICAL POC
9.8 Nov 11

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CON
CVE-2018-16428 CRITICAL POC
9.8 Sep 04

In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference. Rated critical sev
CVE-2020-35457 HIGH POC
7.8 Dec 14

GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entri
CVE-2025-13601 HIGH POC
7.7 Nov 26

Heap-based buffer overflow in GLib's g_escape_uri_string() function allows local attackers to achieve high-integrity and
CVE-2021-27219 HIGH POC
7.5 Feb 15

An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. Rated high severity (CVSS 7.5), this vulne
CVE-2018-16429 HIGH POC
7.5 Sep 04

GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf
CVE-2020-6750 MEDIUM POC
5.9 Jan 09

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting v
CVE-2025-14087 CRITICAL
9.8 Dec 10

Heap corruption in GLib (GNOME's core C utility library) lets remote attackers trigger a buffer-underflow in the GVarian
CVE-2019-12450 CRITICAL
9.8 May 29

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while

CVE-2021-28153 MEDIUM POC
5.3 Mar 11

An issue was discovered in GNOME GLib before 2.66.8. Rated medium severity (CVSS 5.3), this vulnerability is remotely ex
CVE-2024-34397 MEDIUM POC
5.2 May 07

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. Rated medium severity (CVSS 5.
CVE-2026-58016 CRITICAL
9.1 Jun 30

Denial of service in GNOME GLib (versions before 2.88.1) arises when g_dbus_node_info_new_for_xml() parses malformed D-B

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected

Share

CVE-2026-58015 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy