Medium [CVE-2026-15588] GDBusServer pre-authentication DoS via unbounded SASL line buffering
This medium-severity Red Hat Linux advisory covers CVE-2026-15588 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Hardened Images.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client.
An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.
A local or remote unauthenticated attacker could send an engineered stream of data without line length limitations during the authentication process (`gdbusauth`), leading to excessive memory allocation and CPU consumption.
This resource exhaustion can result in a denial-of-service (DoS) condition, causing applications or services dependent on GLib to become unstable or crash. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Weakness: CWE-770. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat Update Infrastructure 5; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4.
Red Hat fixing advisory: RHSA-2026:57015, RHSA-2026:55440, RHSA-2026:39985, RHSA-2026:40485, RHSA-2026:42329, RHSA-2026:58981.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 5 days ago·verify at source
- glib2-0:2.80.4-12.el10_2.21
- glib2-0:2.68.4-19.el9_8.9
- glib2-main-2.89.1-1.1.hum1
- glib2-main-2.89.1-1.2.hum1
- glib2-main-2.89.2-2.hum1
- rhui5/cds-kubernetes-tp-rhel9:1787241211
- rhui5/installer-tp-rhel9:1787135742
- rhui5/rhua-tp-rhel9:1787241260
- RHSA-2026:57015
- RHSA-2026:55440
- RHSA-2026:39985
- RHSA-2026:40485
- RHSA-2026:42329
- RHSA-2026:58981
Official advisory · high-confidence parse· fetched 5 days ago·verify at source
Mitigation checklist
- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Official advisory · high-confidence parse· fetched 5 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.