Bug 2500599

Summary: CVE-2026-15588 glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering [fedora-all]
Product: [Fedora] Fedora Reporter: Ganesh <gnaik>
Component: glib2Assignee: Matthias Clasen <mclasen>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: gnome-sig, lpavan, mclasen, rhughes, rstrode
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["8c9573cd-0a4e-46e9-aabb-1eacbe3c6637"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-08-12 16:44:50 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2499675    

Description Ganesh 2026-07-14 20:14:36 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A `GDBus` authentication denial-of-service / resource exhaustion flaw has been reported. The vulnerability involves a lack of line length limitations when `gdbusauth` reads input from a client. This can be exploited by an unauthenticated remote or local attacker to cause excessive memory and CPU consumption.
Comment 1 lpavan 2026-08-12 16:34:21 UTC 
This was fixed upstream in 2.88.3 and 2.89.2.

Fedora 45 and 44 are not affected (glib 2.89.3 and 2.88.3 respectively). Although Fedora 43 is affected (glib 2.86.5), the CVE is considered low impact in practice. Furthermore, Fedora 43 will EOL on December 9, so no fix is planned.
Comment 2 Adrian Vovk 2026-08-26 00:57:02 UTC 
*** Bug 2500601 has been marked as a duplicate of this bug. ***