CVE-2026-15588

Publication date 20 July 2026

Last updated 21 September 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

5.3 · Medium

Score breakdown

Description

A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.

Status

Package Ubuntu Release Status
glib2.0 26.04 LTS resolute
Fixed in 2.88.0-1ubuntu0.1
24.04 LTS noble
Fixed in 2.80.0-6ubuntu3.9
22.04 LTS jammy
Fixed in 2.72.4-0ubuntu2.10
20.04 LTS focal
Fixed in 2.64.6-1~ubuntu20.04.9+esm2
18.04 LTS bionic
Fixed in 2.56.4-0ubuntu0.18.04.9+esm6
16.04 LTS xenial
Fixed in 2.48.2-0ubuntu4.8+esm6
14.04 LTS trusty
Fixed in 2.40.2-0ubuntu1.1+esm8

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Severity score breakdown

CVSS version: CVSS v3.0

Base score 5.3 · Medium

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

Related Ubuntu Security Notices (USN)

    • USN-8794-1
    • GLib vulnerabilities
    • 21 September 2026

Other references

Access our resources on patching vulnerabilities