Description
A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.17 | — | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.19 | — | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.20 | — | — |
| Red Hat | Red Hat AI Inference Server 3.2 | — | — |
| Red Hat | Red Hat AI Inference Server 3.5 | — | — |
| Red Hat | Red Hat Discovery 2 | — | — |
| Red Hat | Red Hat Enterprise Linux AI 3.5 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat OpenShift AI 3.0 | — | — |
| Red Hat | Red Hat OpenShift AI 3.2 | — | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — | — |
| Red Hat | Red Hat OpenShift AI 3.5 | — | — |
| Red Hat | Red Hat Update Infrastructure 5 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glib2.0 | 2.88.3-1 | — |
| Debian 13 | glib2.0 | 2.84.4-3~deb13u4 | — |
| Debian 12 | glib2.0 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | glib2.0 | 2.88.0-1ubuntu0.1 | USN-8794-1 |
| Ubuntu 24.04 LTS | glib2.0 | 2.80.0-6ubuntu3.9 | USN-8794-1 |
| Ubuntu 22.04 LTS | glib2.0 | 2.72.4-0ubuntu2.10 | USN-8794-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | glib2.0 | 2.64.6-1~ubuntu20.04.9+esm2 | USN-8794-1 |
| Ubuntu Pro 18.04 LTS | glib2.0 | 2.56.4-0ubuntu0.18.04.9+esm6 | USN-8794-1 |
| Ubuntu Pro 16.04 LTS | glib2.0 | 2.48.2-0ubuntu4.8+esm6 | USN-8794-1 |
| Ubuntu Pro 14.04 LTS | glib2.0 | 2.40.2-0ubuntu1.1+esm8 | USN-8794-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | glib2 +4 | 2.80.4-12.el10_2.21 | RHSA-2026:57015 |
| RHEL 9 | glib2 +4 | 2.68.4-19.el9_8.9 | RHSA-2026:55440 |
| RHEL 8 | glib2 +5 | 2.56.4-177.el8_10 | RHSA-2026:61766 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | glib2 +4 | 2.80.4-4.el10_0.17 | RHSA-2026:65767 |
| RHEL 9.6 EUS | glib2 +4 | 2.68.4-16.el9_6.7 | RHSA-2026:65763 |
| RHEL 9.4 E4S | glib2 +3 | 2.68.4-14.el9_4.8 | RHSA-2026:65770 |
| RHEL 9.2 E4S | glib2 +3 | 2.68.4-7.el9_2.7 | RHSA-2026:65768 |
| RHEL 8.8 TUS | glib2 +3 | 2.56.4-165.el8_8.2 | RHSA-2026:65771 |
| RHEL 8.8 E4S | glib2 +3 | 2.56.4-165.el8_8.2 | RHSA-2026:65771 |
| RHEL 8.6 EUS Long Life | glib2 +3 | 2.56.4-158.el8_6.7 | RHSA-2026:65769 |
| RHEL 8.6 AUS | glib2 +3 | 2.56.4-158.el8_6.7 | RHSA-2026:65769 |
| RHEL 8.4 EUS Long Life | glib2 +3 | 2.56.4-10.el8_4.7 | RHSA-2026:65762 |
| RHEL 8.4 AUS | glib2 +3 | 2.56.4-10.el8_4.7 | RHSA-2026:65762 |
| RHEL 7 ELS | glib2 +5 | 2.56.1-13.el7_9.1 | RHSA-2026:65773 |
| Red Hat Hardened Images 1 | glib2 +4 | 2.89.1-1.1.hum1 | RHSA-2026:42329, RHSA-2026:40485, RHSA-2026:39985 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | glib2 +4 | 2.80.4-12.el10_2.21 | ALSA-2026:57015 |
| AlmaLinux 9 | glib2 +4 | 2.68.4-19.el9_8.9 | ALSA-2026:55440 |
| AlmaLinux 8 | glib2 +5 | 2.56.4-177.el8_10 | ALSA-2026:61766 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | glib2 | 2.80.4-12.el10_2.21 | RLSA-2026:57015 |
| Rocky Linux 9 | glib2 | 2.68.4-19.el9_8.9 | RLSA-2026:55440 |
| Rocky Linux 8 | glib2 | 2.56.4-177.el8_10 | RLSA-2026:61766 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | glib2 | 2.78.6-150600.4.41.1 | SUSE-SU-2026:4367-1 |
| SLES 12 SP5 | glib2 | 2.48.2-12.64.1 | SUSE-SU-2026:4348-2, SUSE-SU-2026:4348-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | glib2 +1 | 2.84.4-160000.5.1 | SUSE-SU-2026:23980-1 |
| SLES 16.0 | glib2 +1 | 2.84.4-160000.5.1 | SUSE-SU-2026:23980-1 |
| SLE Micro 6.2 | glib2 | 2.84.4-160000.5.1 | SUSE-SU-2026:23971-1 |
| SLE Micro 6.1 | glib2 | 2.78.6-slfo.1.1_8.1 | SUSE-SU-2026:23928-1 |
| SLE Micro 6.0 | glib2 | 2.76.2-14.1 | SUSE-SU-2026:23880-1 |
| SLE Micro 5.5 | glib2 | 2.70.5-150400.3.40.1 | SUSE-SU-2026:4710-1 |
| SLE Micro 5.4 | glib2 | 2.70.5-150400.3.40.1 | SUSE-SU-2026:4710-1 |
| SLE Micro 5.3 | glib2 | 2.70.5-150400.3.40.1 | SUSE-SU-2026:4710-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | glib2 | 2.88.3-1.1 | openSUSE-SU-2026:11415-1 |
| openSUSE Leap 16.0 | glib2 +1 | 2.84.4-160000.5.1 | openSUSE-SU-2026:21977-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | glib | 2.78.6-11 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | glib2 +4 | 2.80.4-12.el10_2.21 | ELSA-2026-57015 |
| Oracle Linux 9 | glib2 +4 | 2.68.4-19.el9_8.9 | ELSA-2026-55440 |
Advisories 37
- RHSA-2026:61766 Red Hat Security Advisory: glib2 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-2866 Red Hat Enterprise Linux (glib2): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- SUSE-SU-2026:4348-2 Security update for glib2 SUSE / openSUSE Security Updates · Nov 10, 2026
- WID-SEC-2026-3595 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- ALSA-2026:55440 Moderate: glib2 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:57015 Moderate: glib2 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:61766 Moderate: glib2 security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-3623 IBM DataPower Gateway: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
- SUSE-SU-2026:4710-1 Security update for glib2 SUSE / openSUSE Security Updates · Oct 17, 2026
- RHSA-2026:65773 Red Hat Security Advisory: glib2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:65770 Red Hat Security Advisory: glib2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:65771 Red Hat Security Advisory: glib2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:65769 Red Hat Security Advisory: glib2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:65767 Red Hat Security Advisory: glib2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:65768 Red Hat Security Advisory: glib2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:65763 Red Hat Security Advisory: glib2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:65762 Red Hat Security Advisory: glib2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:57015 Red Hat Security Advisory: glib2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:55440 Red Hat Security Advisory: glib2 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- NCSC-2026-0431 Kwetsbaarheden verholpen in IBM DataPower Gateway en onderliggende componenten NCSC-NL (Netherlands) · Oct 16, 2026
- RHSA-2026:42329 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:40485 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:39985 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- SUSE-SU-2026:23971-1 Security update for glib2 SUSE / openSUSE Security Updates · Oct 6, 2026
- SUSE-SU-2026:23980-1 Security update for glib2 SUSE / openSUSE Security Updates · Oct 6, 2026
- openSUSE-SU-2026:21977-1 Security update for glib2 SUSE / openSUSE Security Updates · Oct 1, 2026
- SUSE-SU-2026:23928-1 Security update for glib2 SUSE / openSUSE Security Updates · Sep 30, 2026
- SUSE-SU-2026:4367-1 Security update for glib2 SUSE / openSUSE Security Updates · Sep 29, 2026
- SUSE-SU-2026:23880-1 Security update for glib2 SUSE / openSUSE Security Updates · Sep 28, 2026
- SUSE-SU-2026:4348-1 Security update for glib2 SUSE / openSUSE Security Updates · Sep 25, 2026
- USN-8794-1 glib2.0 vulnerabilities Ubuntu Security Notices (USN) · Sep 22, 2026
- RLSA-2026:61766 Moderate: glib2 security update Rocky Linux Security Advisories · Sep 1, 2026
- RLSA-2026:57015 Moderate: glib2 security update Rocky Linux Security Advisories · Aug 20, 2026
- ELSA-2026-57015 Moderate: glib2 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 19, 2026
- RLSA-2026:55440 Moderate: glib2 security update Rocky Linux Security Advisories · Aug 17, 2026
- ELSA-2026-55440 Moderate: glib2 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 17, 2026
- openSUSE-SU-2026:11415-1 gio-branding-upstream-2.88.3-1.1 on GA media SUSE / openSUSE Security Updates · Aug 2, 2026
References
- RHSA-2026:39985 vendor-advisory
- RHSA-2026:40485 vendor-advisory
- RHSA-2026:42329 vendor-advisory
- RHSA-2026:55440 vendor-advisory
- RHSA-2026:57015 vendor-advisory
- RHSA-2026:58981 vendor-advisory
- RHSA-2026:61766 vendor-advisory
- RHSA-2026:61783 vendor-advisory
- RHSA-2026:63135 vendor-advisory
- RHSA-2026:63138 vendor-advisory
- RHSA-2026:63140 vendor-advisory
- RHSA-2026:65762 vendor-advisory
- RHSA-2026:65763 vendor-advisory
- RHSA-2026:65767 vendor-advisory
- RHSA-2026:65768 vendor-advisory
- RHSA-2026:65769 vendor-advisory
- RHSA-2026:65770 vendor-advisory
- RHSA-2026:65771 vendor-advisory
- RHSA-2026:65773 vendor-advisory
- RHSA-2026:66018 vendor-advisory
- RHSA-2026:72394 vendor-advisory
- RHSA-2026:72395 vendor-advisory
- RHSA-2026:72399 vendor-advisory
- RHSA-2026:72470 vendor-advisory
- RHSA-2026:72475 vendor-advisory
- RHSA-2026:72476 vendor-advisory
- RHSA-2026:72502 vendor-advisory
- RHSA-2026:73859 vendor-advisory
- RHSA-2026:73909 vendor-advisory
- RHSA-2026:73929 vendor-advisory
- RHSA-2026:73930 vendor-advisory
- RHSA-2026:73959 vendor-advisory
- RHSA-2026:73960 vendor-advisory
- RHSA-2026:73961 vendor-advisory
- RHSA-2026:73962 vendor-advisory
- RHSA-2026:74458 vendor-advisory
- RHSA-2026:74459 vendor-advisory
- RHSA-2026:74460 vendor-advisory
- RHSA-2026:74461 vendor-advisory
- RHSA-2026:74462 vendor-advisory
- RHSA-2026:74463 vendor-advisory
- RHSA-2026:74674 vendor-advisory
- RHSA-2026:74677 vendor-advisory
- RHSA-2026:74678 vendor-advisory
- RHSA-2026:74679 vendor-advisory
- RHSA-2026:74681 vendor-advisory
- RHSA-2026:74683 vendor-advisory
- RHSA-2026:74685 vendor-advisory
- RHSA-2026:74687 vendor-advisory
- RHSA-2026:74688 vendor-advisory
- RHSA-2026:74771 vendor-advisory
- RHSA-2026:75652 vendor-advisory
- RHSA-2026:75654 vendor-advisory
- RHSA-2026:75655 vendor-advisory
- RHSA-2026:75657 vendor-advisory
- RHSA-2026:75658 vendor-advisory
- RHSA-2026:75659 vendor-advisory
- RHSA-2026:75660 vendor-advisory
- RHSA-2026:76042 vendor-advisory
- RHSA-2026:80769 vendor-advisory