RHSA-2026:55440MediumCVSS 7.3

Red Hat Security Advisory: glib2 security update

Published
August 17, 2026
Last Modified
August 19, 2026

🔗 CVE IDs covered (7)

CVE-2026-58014 →CVE-2026-58015 →CVE-2026-15588 →CVE-2026-58010 →CVE-2026-58011 →CVE-2026-58012 →CVE-2026-58013 →

📋 Description

CVE-2026-15588 — GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering CVE-2026-58010 — glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() CVE-2026-58011 — glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime CVE-2026-58012 — glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() CVE-2026-58013 — glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" CVE-2026-58014 — glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" CVE-2026-58015 — glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

🎯 Affected products84

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • glib2-0:2.68.4-19.el9_8.9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • glib2-0:2.68.4-19.el9_8.9.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • glib2-0:2.68.4-19.el9_8.9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • glib2-0:2.68.4-19.el9_8.9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • glib2-0:2.68.4-19.el9_8.9.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • glib2-0:2.68.4-19.el9_8.9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • glib2-debuginfo-0:2.68.4-19.el9_8.9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • glib2-debuginfo-0:2.68.4-19.el9_8.9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • glib2-debuginfo-0:2.68.4-19.el9_8.9.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • glib2-debuginfo-0:2.68.4-19.el9_8.9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • glib2-debuginfo-0:2.68.4-19.el9_8.9.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • glib2-debuginfo-0:2.68.4-19.el9_8.9.i686 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • glib2-debuginfo-0:2.68.4-19.el9_8.9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • glib2-debuginfo-0:2.68.4-19.el9_8.9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • glib2-debuginfo-0:2.68.4-19.el9_8.9.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • glib2-debuginfo-0:2.68.4-19.el9_8.9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • glib2-debuginfo-0:2.68.4-19.el9_8.9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • glib2-debuginfo-0:2.68.4-19.el9_8.9.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • glib2-debuginfo-0:2.68.4-19.el9_8.9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • glib2-debuginfo-0:2.68.4-19.el9_8.9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • glib2-debuginfo-0:2.68.4-19.el9_8.9.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • glib2-debugsource-0:2.68.4-19.el9_8.9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • glib2-debugsource-0:2.68.4-19.el9_8.9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • glib2-debugsource-0:2.68.4-19.el9_8.9.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • glib2-debugsource-0:2.68.4-19.el9_8.9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • glib2-debugsource-0:2.68.4-19.el9_8.9.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • glib2-debugsource-0:2.68.4-19.el9_8.9.i686 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • +54 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, in applications processing user-supplied dates, implement input validation to ensure the supplied date is within the supported range before calling g_date_time_add_full() with untrusted data, specifically rejecting inputs that result in a negative or zero days field. Workaround: To mitigate this vulnerability, implement strict input validation to sanitize user-supplied replacement strings, specifically rejecting or escaping case-change modifiers (\u, \l, \U, \L) before calling g_regex_replace() or g_regex_replace_eval() when the G_REGEX_RAW compile flag is used. Removing the G_REGEX_RAW flag or hardcoding the replacement strings will completely neutralize this issue. Workaround: To mitigate this vulnerability, restrict any custom line terminator string passed to g_io_channel_set_line_term() to a maximum length of one byte before calling g_io_channel_read_line_backend(). Using the default line terminators will completely neutralize this issue. Workaround: To mitigate this vulnerability, implement input validation to sanitize untrusted key files (such as .desktop or .ini files), specifically rejecting or stripping empty values before calling g_key_file_get_locale_string_list(). Alternatively, restricting the application to only load key files from trusted sources will completely neutralize this issue. Workaround: To mitigate this vulnerability, ensure that applications only connect to trusted D-Bus servers and operate within secure, isolated networks to prevent man-in-the-middle (MitM) attacks. If feasible, configuring the D-Bus connection to strictly require the EXTERNAL authentication mechanism and disabling DBUS_COOKIE_SHA1 will completely neutralize this issue.

🔗 References (10)