CVE-2026-15588

Publication date 20 July 2026

Last updated 21 September 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

5.3 · Medium

Score breakdown

Description

A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.

Status

Package Ubuntu Release Status
glib2.0 26.04 LTS resolute
Fixed 2.88.0-1ubuntu0.1
24.04 LTS noble
Fixed 2.80.0-6ubuntu3.9
22.04 LTS jammy
Fixed 2.72.4-0ubuntu2.10
20.04 LTS focal
Fixed 2.64.6-1~ubuntu20.04.9+esm2
18.04 LTS bionic
Fixed 2.56.4-0ubuntu0.18.04.9+esm6
16.04 LTS xenial
Fixed 2.48.2-0ubuntu4.8+esm6
14.04 LTS trusty
Fixed 2.40.2-0ubuntu1.1+esm8

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Severity score breakdown

CVSS version: CVSS v3.0

Base score 5.3 · Medium

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

Related Ubuntu Security Notices (USN)

    • USN-8794-1
    • GLib vulnerabilities
    • 21 September 2026

Other references

Access our resources on patching vulnerabilities