CVE-2026-15588VulnerabilityPublished 09/09/2026Updated 10/21/2026

Red Hat Security Advisory: glib2 security update

Affects Red Hat Product Security Red HatSource GCVE Database

Authoritative record:CVE-2026-15588· Medium 5.3

Not known to be exploited · CVSS 5.3 Medium.

Data as of 10/25/2026, 09:03:59 UTC

CVSS base score

5.3Medium

How severe the flaw is on the 0–10 CVSS scale.

Exploitation: Not in CISA KEV, no exploitation reported
EPSS: 0.4% chance of exploitation in 30 days – higher than 40% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

What to do

Affected software

Product	Affected	Fixed in
Red Hat Product Security Red Hat	Affected =3.0 >=3.0.0 Red Hat Red Hat Hardened Images aarch64 glib2-main@aarch64 Red Hat Enterprise Linux Red Hat Enterprise Linux AppStream (v. 9) Red Hat Enterprise Linux BaseOS (v. 9) Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) Red Hat Enterprise Linux AppStream (v. 10) Red Hat Enterprise Linux BaseOS (v. 10) Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) Red Hat Enterprise Linux BaseOS (v. 8) Red Hat Enterprise Linux CRB (v. 8) src Red Hat Enterprise Linux BaseOS AUS (v.8.4) Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) Red Hat Enterprise Linux Server (v. 7 ELS) Red Hat Enterprise Linux Server Optional (v. 7 ELS) SUSE gio-branding-upstream-2.88.3-1.1.aarch64 glib2-devel-2.88.3-1.1.aarch64 glib2-devel-32bit-2.88.3-1.1.aarch64 glib2-devel-0:2.48.2-12.64.1.aarch64 glib2-devel-static-0:2.48.2-12.64.1.aarch64 glib2-tools-0:2.48.2-12.64.1.aarch64 glib2-0:2.89.2-2.hum1@aarch64 i686 glib2-0:2.68.4-16.el9_6.7.i686 glib2-devel-0:2.68.4-16.el9_6.7.i686 glib2-static-0:2.68.4-16.el9_6.7.i686 Red Hat Enterprise Linux AppStream E4S (v.9.2) Red Hat Enterprise Linux BaseOS E4S (v.9.2)	Fixed in–

AI-suggested

Red Hat states that mitigation options either do not exist or do not meet their criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for future updates. Until a fix is released, consider limiting exposure of affected services to untrusted networks and applying any vendor-recommended workarounds if available. Engage with Red Hat support or Technical Account Managers for tailored guidance.

Description

A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.

Impact

The vulnerability allows unauthenticated local or remote attackers to cause denial-of-service by exhausting system memory and CPU resources during the GDBus authentication process. This can lead to instability, crashes, or hangs of applications or services dependent on GLib. The impact is limited to resource consumption and does not include confidentiality or integrity breaches. The severity is rated medium by Red Hat with a CVSS base score of 5.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

Weaknesses

CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V8.1.4 (opens in a new tab)
V13.4.1 (opens in a new tab)
V11.1.4 (opens in a new tab)
Attack patterns
XML Ping of the Death (opens in a new tab)
Exponential Data Expansion (opens in a new tab)
Serialized Data Parameter Blowup (opens in a new tab)
Serialized Data with Nested Payloads (opens in a new tab)
Oversized Serialized Data Payloads (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-126Buffer Over-read (opens in a new tab)
Variant weakness
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-125Out-of-bounds Read (opens in a new tab)
Base weaknessCWE Top 25 (2025): #8
The product reads data past the end, or before the beginning, of the intended buffer.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design · Language Selection
Use a language that provides appropriate memory abstractions.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
Attack patterns
Overread Buffers (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-193Off-by-one Error (opens in a new tab)
Base weakness
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Implementation
When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #6OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
OWASP Cheat Sheets
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V12.3.1 (opens in a new tab)
Attack patterns
Path Traversal (opens in a new tab)
Using Slashes and URL Encoding Combined to Bypass Validation Logic (opens in a new tab)
Manipulating Web Input to File System Calls (opens in a new tab)
Using Escaped Slashes in Alternate Encoding (opens in a new tab)
Using Slashes in Alternate Encoding (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…