Skip to content
Fencer Vulns
medium 5.3

CVE-2026-15588 json

Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering

published 2026-07-20 3 mo ago modified 2026-11-06 3 d ago also EUVD-2026-45939

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:2.80.4-12.el10_2.21
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:2.80.4-4.el10_0.17
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:2.56.1-13.el7_9.1
  • Red Hat Red Hat Enterprise Linux 8 0:2.56.4-177.el8_10
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:2.56.4-10.el8_4.7
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:2.56.4-10.el8_4.7
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:2.56.4-158.el8_6.7
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:2.56.4-158.el8_6.7
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:2.56.4-165.el8_8.2
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:2.56.4-165.el8_8.2
  • Red Hat Red Hat Enterprise Linux 9 0:2.68.4-19.el9_8.9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:2.68.4-7.el9_2.7
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:2.68.4-14.el9_4.8
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:2.68.4-16.el9_6.7
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17 1791371069, 1791371080, 1791378395, 1791788287, 1791970484
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 1789029076, 1791459707, 1791459711, 1791459759, 1791966259
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.19 1788348522, 1788348571, 1788348594
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20 1790223279, 1790223719, 1790272426, 1790589855, 1790589912, 1790589914, 1790589998, 1790598593
  • Red Hat Red Hat AI Inference Server 3.2 1790621713, 1790621714, 1790621718
  • Red Hat Red Hat AI Inference Server 3.5 1791425869, 1791427182, 1791473614, 1791473631, 1791803821, 1791818357
  • Red Hat Red Hat Discovery 2 1788205779, 1788206196
  • Red Hat Red Hat Enterprise Linux AI 3.5 1793135861, 1793135863, 1793194815, 1793194817, 1793194834, 1793206758
  • Red Hat Red Hat Hardened Images 2.89.1-1.1.hum1, 2.89.1-1.2.hum1, 2.89.2-2.hum1
  • Red Hat Red Hat OpenShift AI 3.0 1790276884, 1790276886, 1790276889, 1790276974, 1790277045
  • Red Hat Red Hat OpenShift AI 3.2 1790703494, 1790703497, 1790703506, 1790703568, 1790703586, 1790703590
  • Red Hat Red Hat OpenShift AI 3.4 1790703539, 1790703541, 1790703542, 1790703545, 1790703553, 1790703597, 1790703630, 1790703631, 1790703641, 1791231926, 1791232048
  • Red Hat Red Hat OpenShift AI 3.5 1790703552, 1790703554, 1790703557, 1790703630, 1790703645, 1790703656, 1790703706, 1790703707
  • Red Hat Red Hat Update Infrastructure 5 1787135742, 1787241211, 1787241260, 1788765051, 1788880445, 1788880456, 1788880464, 1788880581
  • glib2.0 Debian 13 2.84.4-3~deb13u4
  • glib2.0 Debian 14 2.88.3-1

debian advisories DEBIAN-CVE-2026-15588

  • glib2.0 Ubuntu 22.04 LTS 2.72.4-0ubuntu2.10
  • glib2.0 Ubuntu 24.04 LTS 2.80.0-6ubuntu3.9
  • glib2.0 Ubuntu 26.04 LTS 2.88.0-1ubuntu0.1
  • glib2.0 Ubuntu Pro 14.04 LTS 2.40.2-0ubuntu1.1+esm8
  • glib2.0 Ubuntu Pro 16.04 LTS 2.48.2-0ubuntu4.8+esm6
  • glib2.0 Ubuntu Pro 18.04 LTS 2.56.4-0ubuntu0.18.04.9+esm6
  • glib2.0 Ubuntu Pro 20.04 LTS 2.64.6-1~ubuntu20.04.9+esm2

ubuntu advisories UBUNTU-CVE-2026-15588

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • glib2 RHEL 8 2.56.4-177.el8_10
  • glib2-fam RHEL 8 2.56.4-177.el8_10
  • glib2-tests RHEL 8 2.56.4-177.el8_10
  • glib2 RHEL 10.2 2.80.4-12.el10_2.21
  • glib2-tests RHEL 10.2 2.80.4-12.el10_2.21
  • glib2 RHEL 9 2.68.4-19.el9_8.9
  • glib2-tests RHEL 9 2.68.4-19.el9_8.9
  • glib2 hummingbird 1 2.89.2-2.hum1

red hat advisories RHSA-2026:65773RHSA-2026:65770RHSA-2026:65771RHSA-2026:65767RHSA-2026:65768RHSA-2026:65769

  • glib2 SLE Micro 5.5, SLE Micro 5.4, SLE Micro 5.3 2.70.5-150400.3.40.1
  • glib2 SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 2.84.4-160000.5.1
  • glib2 SLE Module for Basesystem 15 SP7 2.78.6-150600.4.41.1
  • glib2 Linux Micro 6.0 2.76.2-14.1
  • glib2 Linux Micro 6.1 2.78.6-slfo.1.1_8.1
  • glib2 SLES LTSS Extended Security 12 SP5 2.48.2-12.64.1

suse advisories SUSE-SU-2026:4710-1SUSE-SU-2026:23971-1SUSE-SU-2026:23980-1SUSE-SU-2026:4367-1SUSE-SU-2026:4348-1SUSE-SU-2026:23880-1

  • glib2 openSUSE Leap 16.0 2.84.4-160000.5.1
  • glib2 openSUSE Tumbleweed 2.88.3-1.1

opensuse advisories openSUSE-SU-2026:21977-1openSUSE-SU-2026:11415-1

  • glib2 AlmaLinux 8 2.56.4-177.el8_10
  • glib2-fam AlmaLinux 8 2.56.4-177.el8_10
  • glib2-tests AlmaLinux 8 2.56.4-177.el8_10
  • glib2 AlmaLinux 10 2.80.4-12.el10_2.21
  • glib2-tests AlmaLinux 10 2.80.4-12.el10_2.21
  • glib2 AlmaLinux 9 2.68.4-19.el9_8.9
  • glib2-tests AlmaLinux 9 2.68.4-19.el9_8.9

almalinux advisories ALSA-2026:61766ALSA-2026:57015ALSA-2026:55440

  • glib2 Rocky Linux 8 2.56.4-177.el8_10
  • glib2 Rocky Linux 10 2.80.4-12.el10_2.21
  • glib2 Rocky Linux 9 2.68.4-19.el9_8.9

rocky linux advisories RLSA-2026:61766RLSA-2026:57015RLSA-2026:55440

  • glib Azure Linux 3.0 2.78.6-11

azure linux advisories AZL-92994

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-15588 updated cvss 5.3

GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering

  • Red Hat Enterprise Linux 6 glib2
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 mingw-glib2, mingw32-glib2, mingw64-glib2 Red Hat Enterprise Linux 9 mingw-glib2, mingw32-glib2, mingw64-glib2 Red Hat Enterprise Linux 10 mingw-glib2, mingw32-glib2, mingw64-glib2 Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17 cert-manager/cert-manager-operator-rhel9 1791788287, cert-manager/jetstack-cert-manager-rhel9 1791371069, cert-manager/cert-manager-istio-csr-rhel9 1791378395, cert-manager/cert-manager-operator-bundle 1791970484, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791371080
    fixed: vendor fix RHSA-2026:82336
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 cert-manager/cert-manager-operator-rhel9 1789029076, cert-manager/jetstack-cert-manager-rhel9 1791459711, cert-manager/cert-manager-istio-csr-rhel9 1791459759, cert-manager/cert-manager-operator-bundle 1791966259, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791459707
    fixed: vendor fix RHSA-2026:82354
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.19 cert-manager/cert-manager-operator-rhel9 1788348522, cert-manager/jetstack-cert-manager-rhel9 1788348571, cert-manager/cert-manager-istio-csr-rhel9 1788348594, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1788348571
    fixed: vendor fix RHSA-2026:63140
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20 cert-manager/cert-manager-operator-rhel9 1790272426, cert-manager/cert-manager-operator-rhel9 1790589855, cert-manager/jetstack-cert-manager-rhel9 1790223279, cert-manager/jetstack-cert-manager-rhel9 1790589912, cert-manager/cert-manager-istio-csr-rhel9 1790223719, cert-manager/cert-manager-istio-csr-rhel9 1790589914, +2 more
    fixed: vendor fix RHSA-2026:72475
  • Red Hat AI Inference Server 3.2 rhaiis/vllm-cuda-rhel9 1790621718, rhaiis/vllm-rocm-rhel9 1790621713, rhaiis/model-opt-cuda-rhel9 1790621714
    fixed: vendor fix RHSA-2026:73859
  • Red Hat AI Inference Server 3.5 rhaii/vllm-cpu-rhel9 1791473614, rhaii/vllm-cuda-rhel9 1791473631, rhaii/vllm-rocm-rhel9 1791425869, rhaii/vllm-gaudi-rhel9 1791427182, rhaii/vllm-spyre-rhel9 1791818357, rhaii/model-opt-cuda-rhel9 1791803821
    fixed: vendor fix RHSA-2026:82066
show 27 more
  • Red Hat CodeReady Linux Builder EUS (v.9.6) glib2-static 2.68.4-16.el9_6.7, glib2-debuginfo 2.68.4-16.el9_6.7, glib2-debugsource 2.68.4-16.el9_6.7, glib2-devel-debuginfo 2.68.4-16.el9_6.7, glib2-tests-debuginfo 2.68.4-16.el9_6.7
    fixed: vendor fix RHSA-2026:65763
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 1788206196, discovery/discovery-server-rhel9 1788205779
    fixed: vendor fix RHSA-2026:61783
  • Red Hat Enterprise Linux AI 3.5 rhelai3/bootc-cuda-rhel9 1793135861, rhelai3/bootc-rocm-rhel9 1793135863, rhelai3/bootc-aws-cuda-rhel9 1793194817, rhelai3/bootc-gcp-cuda-rhel9 1793194815, rhelai3/disk-image-cuda-rhel9 1793206758, rhelai3/bootc-azure-cuda-rhel9 1793194815, +1 more
    fixed: vendor fix RHSA-2026:92452
  • Red Hat Enterprise Linux AppStream (v. 9) glib2-tests 2.68.4-19.el9_8.9
    fixed: vendor fix RHSA-2026:55440
  • Red Hat Enterprise Linux AppStream (v. 10) glib2-tests 2.80.4-12.el10_2.21
    fixed: vendor fix RHSA-2026:57015
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) glib2-tests 2.68.4-7.el9_2.7
    fixed: vendor fix RHSA-2026:65768
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) glib2-tests 2.68.4-14.el9_4.8
    fixed: vendor fix RHSA-2026:65770
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) glib2-tests 2.80.4-4.el10_0.17
    fixed: vendor fix RHSA-2026:65767
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) glib2-tests 2.68.4-16.el9_6.7
    fixed: vendor fix RHSA-2026:65763
  • Red Hat Enterprise Linux BaseOS (v. 8) glib2 2.56.4-177.el8_10, glib2-fam 2.56.4-177.el8_10, glib2-tests 2.56.4-177.el8_10
    fixed: vendor fix RHSA-2026:61766
  • Red Hat Enterprise Linux BaseOS (v. 9) glib2 2.68.4-19.el9_8.9
    fixed: vendor fix RHSA-2026:55440
  • Red Hat Enterprise Linux BaseOS (v. 10) glib2 2.80.4-12.el10_2.21
    fixed: vendor fix RHSA-2026:57015
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) glib2 2.56.4-10.el8_4.7, glib2-fam 2.56.4-10.el8_4.7, glib2-tests 2.56.4-10.el8_4.7
    fixed: vendor fix RHSA-2026:65762
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) glib2 2.56.4-158.el8_6.7, glib2-fam 2.56.4-158.el8_6.7, glib2-tests 2.56.4-158.el8_6.7
    fixed: vendor fix RHSA-2026:65769
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) glib2 2.56.4-165.el8_8.2, glib2-fam 2.56.4-165.el8_8.2, glib2-tests 2.56.4-165.el8_8.2
    fixed: vendor fix RHSA-2026:65771
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) glib2 2.68.4-7.el9_2.7
    fixed: vendor fix RHSA-2026:65768
  • Red Hat Enterprise Linux BaseOS E4S (v.9.4) glib2 2.68.4-14.el9_4.8
    fixed: vendor fix RHSA-2026:65770
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) glib2 2.80.4-4.el10_0.17
    fixed: vendor fix RHSA-2026:65767
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) glib2 2.68.4-16.el9_6.7
    fixed: vendor fix RHSA-2026:65763
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) glib2 2.56.4-10.el8_4.7, glib2-fam 2.56.4-10.el8_4.7, glib2-tests 2.56.4-10.el8_4.7
    fixed: vendor fix RHSA-2026:65762
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) glib2 2.56.4-158.el8_6.7, glib2-fam 2.56.4-158.el8_6.7, glib2-tests 2.56.4-158.el8_6.7
    fixed: vendor fix RHSA-2026:65769
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) glib2 2.56.4-165.el8_8.2, glib2-fam 2.56.4-165.el8_8.2, glib2-tests 2.56.4-165.el8_8.2
    fixed: vendor fix RHSA-2026:65771
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) glib2-static 2.68.4-19.el9_8.9, glib2-debuginfo 2.68.4-19.el9_8.9, glib2-debugsource 2.68.4-19.el9_8.9, glib2-devel-debuginfo 2.68.4-19.el9_8.9, glib2-tests-debuginfo 2.68.4-19.el9_8.9
    fixed: vendor fix RHSA-2026:55440
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) glib2-doc 2.80.4-12.el10_2.21, glib2-static 2.80.4-12.el10_2.21, glib2-debuginfo 2.80.4-12.el10_2.21, glib2-debugsource 2.80.4-12.el10_2.21, glib2-devel-debuginfo 2.80.4-12.el10_2.21, glib2-tests-debuginfo 2.80.4-12.el10_2.21
    fixed: vendor fix RHSA-2026:57015
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) glib2-doc 2.80.4-4.el10_0.17, glib2-static 2.80.4-4.el10_0.17, glib2-debuginfo 2.80.4-4.el10_0.17, glib2-debugsource 2.80.4-4.el10_0.17, glib2-devel-debuginfo 2.80.4-4.el10_0.17, glib2-tests-debuginfo 2.80.4-4.el10_0.17
    fixed: vendor fix RHSA-2026:65767
  • Red Hat Enterprise Linux CRB (v. 8) glib2-doc 2.56.4-177.el8_10, glib2-static 2.56.4-177.el8_10, glib2-debuginfo 2.56.4-177.el8_10, glib2-debugsource 2.56.4-177.el8_10, glib2-fam-debuginfo 2.56.4-177.el8_10, glib2-devel-debuginfo 2.56.4-177.el8_10, +1 more
    fixed: vendor fix RHSA-2026:61766
  • Red Hat Enterprise Linux Server (v. 7 ELS) glib2 2.56.1-13.el7_9.1 Red Hat Enterprise Linux Server Optional (v. 7 ELS) glib2-fam 2.56.1-13.el7_9.1, glib2-tests 2.56.1-13.el7_9.1
    fixed: vendor fix RHSA-2026:65773

6 more fixed, 3 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.58% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • gitlab.gnome.org https://gitlab.gnome.org/GNOME/glib/-/issues/3985 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.19
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20
  • Red Hat Red Hat AI Inference Server 3.2
  • Red Hat Red Hat AI Inference Server 3.5
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat Enterprise Linux AI 3.5
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat OpenShift AI 3.0
  • Red Hat Red Hat OpenShift AI 3.2
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat Red Hat OpenShift AI 3.5
  • Red Hat Red Hat Update Infrastructure 5
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Container Platform 5

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.