CVE-2026-15588: Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering
A GDBus authentication denial-of-service / resource exhaustion flaw has been reported. The vulnerability involves a lack of line length limitations when gdbusauth reads input from a client. This can be exploited by an unauthenticated remote or local attacker to cause excessive memory and CPU consumption.
Other sources
A denial-of-service and resource exhaustion vulnerability exists within the GDBus component of GLib. The gdbusauth authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15588?
The severity of CVE-2026-15588 is rated as medium with a score of 5.3.
What type of vulnerability is CVE-2026-15588?
CVE-2026-15588 is a denial-of-service vulnerability related to unbounded SASL line buffering in gdbusserver.
How do I fix CVE-2026-15588?
To fix CVE-2026-15588, update the GNOME GLib package to the latest version where the vulnerability is addressed.
Who is affected by CVE-2026-15588?
CVE-2026-15588 affects users of the Gnome GLib gdbusserver component.
Can CVE-2026-15588 be exploited remotely?
Yes, CVE-2026-15588 can be exploited by an unauthenticated local or remote attacker.