Log in Start free

Vulnerability · Published Jul 20, 2026 · Assigned by redhat

CVE-2026-15588Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering

Medium 5.3

In plain English

A medium-severity resource allocation without limits in Cert Manager support for Red Hat OpenShift release 1.17 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.5%top 58.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10glib22.80.4-12.el10_2.21ALSA-2026:57015
AlmaLinux:8glib22.56.4-177.el8_10ALSA-2026:61766
AlmaLinux:9glib22.68.4-19.el9_8.9ALSA-2026:55440
AlmaLinux:10glib2-devel2.80.4-12.el10_2.21ALSA-2026:57015
AlmaLinux:8glib2-devel2.56.4-177.el8_10ALSA-2026:61766
AlmaLinux:9glib2-devel2.68.4-19.el9_8.9ALSA-2026:55440
AlmaLinux:10glib2-doc2.80.4-12.el10_2.21ALSA-2026:57015
AlmaLinux:8glib2-doc2.56.4-177.el8_10ALSA-2026:61766
AlmaLinux:9glib2-doc2.68.4-19.el9_8.9ALSA-2026:55440
AlmaLinux:8glib2-fam2.56.4-177.el8_10ALSA-2026:61766
AlmaLinux:10glib2-static2.80.4-12.el10_2.21ALSA-2026:57015
AlmaLinux:8glib2-static2.56.4-177.el8_10ALSA-2026:61766
AlmaLinux:9glib2-static2.68.4-19.el9_8.9ALSA-2026:55440
AlmaLinux:10glib2-tests2.80.4-12.el10_2.21ALSA-2026:57015
AlmaLinux:8glib2-tests2.56.4-177.el8_10ALSA-2026:61766
AlmaLinux:9glib2-tests2.68.4-19.el9_8.9ALSA-2026:55440
Debian:12glib2.0no fix listedDEBIAN-CVE-2026-15588
Debian:13glib2.02.84.4-3~deb13u4DEBIAN-CVE-2026-15588
Debian:14glib2.02.88.3-1DEBIAN-CVE-2026-15588
Rocky Linux:10glib20:2.80.4-12.el10_2.21RLSA-2026:57015
Rocky Linux:8glib20:2.56.4-177.el8_10RLSA-2026:61766
Rocky Linux:9glib20:2.68.4-19.el9_8.9RLSA-2026:55440
Ubuntu:22.04:LTSglib2.02.72.4-0ubuntu2.10USN-8794-1
Ubuntu:22.04:LTSglib2.02.72.4-0ubuntu2.10UBUNTU-CVE-2026-15588
Ubuntu:24.04:LTSglib2.02.80.0-6ubuntu3.9USN-8794-1
Ubuntu:24.04:LTSglib2.02.80.0-6ubuntu3.9UBUNTU-CVE-2026-15588
Ubuntu:26.04:LTSglib2.02.88.0-1ubuntu0.1UBUNTU-CVE-2026-15588
Ubuntu:26.04:LTSglib2.02.88.0-1ubuntu0.1USN-8794-1

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.19 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.19 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.19 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.19 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.20 see references

Weakness: CWE-770 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References