CVE-2026-15588 is a resource exhaustion vulnerability in the GDBus component of GLib, specifically in the gdbusauth authentication mechanism. The flaw arises because the mechanism does not enforce length limits on data lines read from clients, allowing an unauthenticated attacker to send overly long streams of data. This leads to excessive allocation of system memory and CPU resources, potentially causing denial-of-service conditions such as application crashes or system hangs. The vulnerability affects Red Hat Hardened Images RPMs, including multiple glib2 packages for aarch64 and x86_64 architectures. Red Hat has published an advisory (RHSA-2026:39985) describing the issue but has not released a patch or official fix. Mitigation options are currently unavailable or insufficient according to Red Hat's security criteria.

The vulnerability allows unauthenticated local or remote attackers to cause denial-of-service by exhausting system memory and CPU resources during the GDBus authentication process. This can lead to instability, crashes, or hangs of applications or services dependent on GLib. The impact is limited to resource consumption and does not include confidentiality or integrity breaches. The severity is rated medium by Red Hat with a CVSS base score of 5.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

No official fix or patch is currently available for this vulnerability. Red Hat states that mitigation options either do not exist or do not meet their criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for future updates. Until a fix is released, consider limiting exposure of affected services to untrusted networks and applying any vendor-recommended workarounds if available. Engage with Red Hat support or Technical Account Managers for tailored guidance.