Vulnerability · Published Sep 28, 2026 · Assigned by redhat
CVE-2026-97027Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files
Low 3.6
In plain English
A low-severity improper input validation in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service (e.g. forced application restart loops) or to influence host D-Bus/systemd activation behavior beyond what the sandbox is intended to permit.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | flatpak | no fix listed | DEBIAN-CVE-2026-97027 |
| Debian:13 | flatpak | 1.16.6-1~deb13u3 | DEBIAN-CVE-2026-97027 |
| Debian:14 | flatpak | 1.18.4-1 | DEBIAN-CVE-2026-97027 |
| Ubuntu:26.04:LTS | flatpak | no fix listed | UBUNTU-CVE-2026-97027 |
| Ubuntu:26.10 | flatpak | no fix listed | UBUNTU-CVE-2026-97027 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L
References
- https://access.redhat.com/security/cve/CVE-2026-97027 vdb-entry, x_refsource_REDHAT
- RHBZ#2542683 issue-tracking, x_refsource_REDHAT
- https://github.com/flatpak/flatpak/security/advisories/GHSA-v64f-hrwr-j4vh