CVE-2026-15588

mediumCVSS 5.3covered by 2 sourcesfirst seen 2026-07-14

A denial-of-service and resource exhaustion vulnerability exists within the GDBus component of GLib. The gdbusauth authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.

CSIRTS triage

What: gdbusserver is vulnerable to a denial of service via unbounded SASL line buffering.
Who is affected: Deployments using gdbusserver in glib2.
Urgency: Medium urgency due to a CVSS score of 5.3 indicating moderate severity.
Action: Apply available patches or updates for glib2.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-15588

Get an email if CVE-2026-15588 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all EPSS-scored CVEs.

Advisory coverage (2)

mediumCVE-2026-15588: A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component …nvd · 2026-07-20
mediumCVE-2026-15588: Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line bufferingmsrc · 2026-07-14

External references

NVD record for CVE-2026-15588

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-15588 status](https://www.csirts.com/badge/CVE-2026-15588)](https://www.csirts.com/cve/CVE-2026-15588)