# CVE-2026-15588: GNOME GLib denial of service in GDBus authentication

Source: https://junglewise.ai/threats/cve-2026-15588-gnome-glib-denial-of-service-in-gdbus-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-15588 · Severity: medium · CVSS 5.3 · Published 2026-07-20

A security vulnerability exists in GLib, a fundamental software library used by many Linux applications to handle communication between different programs. An attacker can send a continuous stream of data to a service using this library, forcing it to consume all available system memory and processor power. This can cause the affected application or the entire system to crash or become unresponsive, leading to a denial of service.

Technologies: [Gnome Glib](https://junglewise.ai/threats/technologies/glib), [Red Hat Enterprise Linux 10](https://junglewise.ai/threats/technologies/enterprise-linux-10), [Red Hat Enterprise Linux 6](https://junglewise.ai/threats/technologies/enterprise-linux-6), [Red Hat Enterprise Linux 7](https://junglewise.ai/threats/technologies/enterprise-linux-7), [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9). Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-15588 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15588 being exploited in the wild.

**How severe is CVE-2026-15588?** Medium severity, with a CVSS score of 5.3, published 20 July 2026.

**Which products and versions are affected?** Gnome Glib 2.26.0 to 2.80.x (starting from 2.25.8).

**Is there a fix for CVE-2026-15588?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15588 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-15588?** Check whether you run Gnome Glib, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A resource exhaustion vulnerability (CWE-770) exists in the GDBusServer implementation within GLib's GIO module. The root cause is located in the `_my_g_input_stream_read_line_safe()` function in `gio/gdbusauth.c`, which reads D-Bus SASL authentication commands one byte at a time into a GString until a CRLF terminator is encountered, without enforcing a maximum line length. An unauthenticated local or remote attacker can exploit this by sending an excessively long, unterminated AUTH line (e.g., AUTH EXTERNAL followed by infinite data). This causes the target process to allocate memory until it either aborts due to a GLib allocation failure or is terminated by the operating system's out-of-memory (OOM) killer. The vulnerability is reachable pre-authentication, meaning no valid credentials are required to trigger the crash.

## Affected products

- GNOME GLib 2.26.0 to 2.80.x (starting from 2.25.8)
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10

## Timeline

- 2026-07-13: other: Initial bug report in Red Hat Bugzilla
- 2026-07-20: disclosed: Public disclosure of CVE-2026-15588

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-15588](https://access.redhat.com/security/cve/CVE-2026-15588)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2499675](https://bugzilla.redhat.com/show_bug.cgi?id=2499675)
- [https://gitlab.gnome.org/GNOME/glib/-/issues/3985](https://gitlab.gnome.org/GNOME/glib/-/issues/3985)

## Related threats

- [Red Hat yggdrasil-worker-package-manager argument injection in APT backend](https://junglewise.ai/threats/cve-2026-18157-red-hat-yggdrasil-worker-package-manager-argument-injection-in)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)
- [Red Hat PCP auth bypass in pmproxy /store endpoint](https://junglewise.ai/threats/cve-2026-16527-red-hat-pcp-auth-bypass-in-pmproxy-store-endpoint)