A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55440 advisory.

    GLib provides the core application building blocks for libraries and applications written in C. It     provides the core object system used in GNOME, the main loop implementation, and a large set of utility     functions for strings and common data structures.

    Security Fix(es):

    * glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() (CVE-2026-58010)

    * glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime (CVE-2026-58011)

    * glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()     (CVE-2026-58012)

    * glib: buffer over-read in glib/giochannel.c via g_io_channel_read_line_backend (CVE-2026-58013)

    * glib: off-by-one error in glib/gkeyfile.c via g_key_file_get_locale_string_list (CVE-2026-58014)

    * glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and     mechanism_client_data_receive (CVE-2026-58015)

    * GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering     (CVE-2026-15588)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2dfeac0818 advisory.

    Update to 2.88.3.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The     `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a     client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending     excessively long streams of data, causing the application to consume massive amounts of system memory and     CPU, potentially leading to a crash or system hang. (CVE-2026-15588)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
335957	RHEL 9 : glib2 (RHSA-2026:55440)	Nessus	Red Hat Local Security Checks	Local	high
333515	Fedora 44 : mingw-glib2 (2026-2dfeac0818)	Nessus	Fedora Local Security Checks	Local	medium
327997	Linux Distros Unpatched Vulnerability : CVE-2026-15588	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-15588

medium

Tenable Plugins

high

medium

medium