{"id":"CVE-2026-15588","title":"A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib","summary":"A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticat…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cwe":["CWE-770"],"vendor":"Red Hat","product":"glib2","affected":["glib2 (all versions)","glib2 (all versions)","glib2 (all versions)","glib2 (all versions)","glib2 (all versions)","glib2 (all versions)","glib2 (all versions)","glib2 (all versions)","glib2 (all versions)","glib2 (all versions)","glib2 (all versions)","glib2 (all versions)","glib2 (all versions)","glib2 (all versions)","glib2 (all versions)","cert-manager/cert-manager-operator-rhel9 (all versions)","cert-manager/jetstack-cert-manager-acmesolver-rhel9 (all versions)","cert-manager/jetstack-cert-manager-rhel9 (all versions)","cert-manager/cert-manager-istio-csr-rhel9 (all versions)","discovery/discovery-server-rhel9 (all versions)","discovery/discovery-ui-rhel9 (all versions)","glib2-main (all versions)","glib2-main (all versions)","glib2-main (all versions)","rhui5/cds-kubernetes-tp-rhel9 (all versions)","rhui5/installer-tp-rhel9 (all versions)","rhui5/rhua-tp-rhel9 (all versions)","rhui5/cds-kubernetes-rhel9 (all versions)","rhui5/cds-rhel9 (all versions)","rhui5/haproxy-rhel9 (all versions)","rhui5/installer-rhel9 (all versions)","rhui5/rhua-rhel9 (all versions)","mingw-glib2 (all versions)","glib2 (all versions)","mingw-glib2 (all versions)","mingw-glib2 (all versions)","openshift/ose-rhel-coreos-8 (all versions)","openshift/ose-rhel-coreos-9 (all versions)"],"patched":["enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_8","enterprise_linux_baseos_aus_v_8_4","enterprise_linux_baseos_eus_extension_v_8_4","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_crb_v_8","enterprise_linux_codeready_linux_builder_v_9","cert_manager_support_for_red_hat_openshift_release 1.19","discovery 2","hardened_images","update_infrastructure 5"],"published":"2026-07-20","updated":"2026-09-10","sourceUpdated":"2026-09-10T18:17:56.303","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-15588","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:39985","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:40485","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:42329","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:55440","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:57015","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:58981","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:61766","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:61783","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:63135","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:63138","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:63140","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:65762","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:65763","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:65767","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:65768","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:65769","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:65770","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:65771","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:65773","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:66018","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-15588","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499675","label":"secalert@redhat.com"},{"url":"https://gitlab.gnome.org/GNOME/glib/-/issues/3985","label":"secalert@redhat.com"},{"url":"https://gitlab.gnome.org/GNOME/glib/-/issues/3985","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15588.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15588"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15588"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-20T13:49:28.904247Z"},"epss":0.00225,"epssPercentile":0.13351,"ingestedAt":"2026-09-08T23:13:54.646Z","slug":"CVE-2026-15588","body":"## Overview\n\nA denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:57015** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:57015)\n- **RHSA-2026:55440** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55440)\n- **RHSA-2026:61766** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61766)\n- **RHSA-2026:65762** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65762)\n- **RHSA-2026:63140** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63140)\n- **RHSA-2026:63135** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63135)\n- **RHSA-2026:63138** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63138)\n- **RHSA-2026:61783** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61783)\n- **RHSA-2026:39985** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:39985)\n- **RHSA-2026:58981** · Red Hat · fixed in: Red Hat Update Infrastructure 5 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:58981)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, … · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15588.json)\n- **RHSA-2026:65773** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65773)\n- **RHSA-2026:65767** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65767)\n- **RHSA-2026:65768** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65768)\n- **RHSA-2026:65770** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65770)\n- **RHSA-2026:65763** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65763)\n- **RHSA-2026:65769** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65769)\n- **RHSA-2026:65771** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65771)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}