CVE catalog

CVE-2026-34080

xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules bu

[CVE catalog]

Severity
Medium · CVSS 6.8
Published
Source
[NVD] · [CVE record]
EPSS
0.18% · Oct 25, 2026

xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianxdg-dbus-proxysid0.1.9-1fixed
Debianxdg-dbus-proxyforky0.1.9-1fixed
Debianxdg-dbus-proxytrixie0.1.6-1+deb13u2fixed
Debianxdg-dbus-proxytrixie-security0.1.6-1+deb13u3fixed
Debianxdg-dbus-proxybookworm0.1.4-3+deb12u1fixed
Debianxdg-dbus-proxybookworm-security0.1.4-3+deb12u2fixed
Cpexdg-dbus-proxyNot reported0.1.5-1ubuntu0.2fixed
Cpexdg-dbus-proxy-testsNot reported0.1.5-1ubuntu0.2fixed
Cpexdg-dbus-proxyNot reported0.1.7fixed
Cpexdg-dbus-proxyNot reported0.1.4-3+deb12u1fixed
Susexdg-dbus-proxylinux enterprise module for basesystem 15 sp70.1.5-150600.3.5.1fixed
Susexdg-dbus-proxylinux enterprise server 16.00.1.6-160000.3.1fixed
Susexdg-dbus-proxylinux enterprise server for sap applications 16.00.1.6-160000.3.1fixed
Opensusexdg-dbus-proxyleap 16.00.1.6-160000.3.1fixed
Ubuntuxdg-dbus-proxypro0.1.1-1vulnerable
Ubuntuxdg-dbus-proxypro0.1.2-1vulnerable
Ubuntuxdg-dbus-proxypro0.1.2-1ubuntu0.1~esm1fixed
Ubuntuxdg-dbus-proxy22.040.1.2-2build1vulnerable
Ubuntuxdg-dbus-proxy22.040.1.3-1vulnerable
Ubuntuxdg-dbus-proxy22.040.1.3-1ubuntu0.1fixed
Ubuntuxdg-dbus-proxy24.040.1.5-1vulnerable
Ubuntuxdg-dbus-proxy24.040.1.5-1build1vulnerable
Ubuntuxdg-dbus-proxy24.040.1.5-1build2vulnerable
Ubuntuxdg-dbus-proxy24.040.1.5-1ubuntu0.1vulnerable
Ubuntuxdg-dbus-proxy24.040.1.5-1ubuntu0.2fixed
Ubuntuxdg-dbus-proxy25.100.1.6-1vulnerable
Ubuntuxdg-dbus-proxy25.100.1.6-1ubuntu0.1fixed
Ubuntuxdg-dbus-proxy22.040.1.2-2build1vulnerable
Ubuntuxdg-dbus-proxy22.040.1.3-1vulnerable
Ubuntuxdg-dbus-proxy22.040.1.3-1ubuntu0.1fixed
Ubuntuxdg-dbus-proxy24.040.1.5-1vulnerable
Ubuntuxdg-dbus-proxy24.040.1.5-1build1vulnerable
Ubuntuxdg-dbus-proxy24.040.1.5-1build2vulnerable
Ubuntuxdg-dbus-proxy24.040.1.5-1ubuntu0.1vulnerable
Ubuntuxdg-dbus-proxy24.040.1.5-1ubuntu0.2fixed
Ubuntuxdg-dbus-proxy25.100.1.6-1vulnerable
Ubuntuxdg-dbus-proxy25.100.1.6-1ubuntu0.1fixed
Opensusexdg-dbus-proxytumbleweed0.1.7-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianxdg-dbus-proxysourcesid0.1.7-1not yet assignedNot reported[1132939]
Debianxdg-dbus-proxysourceforky0.1.7-1not yet assignedNot reported[1132939]
Debianxdg-dbus-proxysourcetrixie0.1.6-1+deb13u1not yet assignedNot reported[1132939]
Debianxdg-dbus-proxysourcebookworm0.1.4-3+deb12u1not yet assignedNot reported[1132939]
Cpexdg-dbus-proxycpeNot reported0.1.5-1ubuntu0.2Not reportedNot reportedNot reported
Cpexdg-dbus-proxy-testscpeNot reported0.1.5-1ubuntu0.2Not reportedNot reportedNot reported
Cpexdg-dbus-proxycpeNot reported0.1.7Not reportedNot reportedNot reported
Cpexdg-dbus-proxycpeNot reported0.1.4-3+deb12u1Not reportedNot reportedNot reported
Susexdg-dbus-proxyrpmlinux enterprise module for basesystem 15 sp70.1.5-150600.3.5.1Not reportedSUSE-SU-2026:2755-1Not reported
Susexdg-dbus-proxyrpmlinux enterprise server 16.00.1.6-160000.3.1Not reportedSUSE-SU-2026:22096-1Not reported
Susexdg-dbus-proxyrpmlinux enterprise server for sap applications 16.00.1.6-160000.3.1Not reportedSUSE-SU-2026:22096-1Not reported
Opensusexdg-dbus-proxyrpmleap 16.00.1.6-160000.3.1Not reportedOPENSUSE-SU-2026:20934-1Not reported
Ubuntuxdg-dbus-proxydebpro0.1.2-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2026-34080Not reported
Ubuntuxdg-dbus-proxydeb22.040.1.3-1ubuntu0.1Not reportedUBUNTU-CVE-2026-34080Not reported
Ubuntuxdg-dbus-proxydeb24.040.1.5-1ubuntu0.2Not reportedUBUNTU-CVE-2026-34080Not reported
Ubuntuxdg-dbus-proxydeb25.100.1.6-1ubuntu0.1Not reportedUBUNTU-CVE-2026-34080Not reported
Ubuntuxdg-dbus-proxydeb22.040.1.3-1ubuntu0.1Not reportedUSN-8167-1Not reported
Ubuntuxdg-dbus-proxydeb24.040.1.5-1ubuntu0.2Not reportedUSN-8167-1Not reported
Ubuntuxdg-dbus-proxydeb25.100.1.6-1ubuntu0.1Not reportedUSN-8167-1Not reported
Opensusexdg-dbus-proxyrpmtumbleweed0.1.7-1.1Not reportedOPENSUSE-SU-2026:10625-1Not reported

[Debian bug #1132939]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [xdg-dbus-proxy-tests]Unknown

    Source package: [xdg-dbus-proxy]

    Details (1)

    • 0.1.8-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.1.7-1.1

      Version impact unknown

      nvd · xdg-dbus-proxy · opensuse · tumbleweed

  • [xdg-dbus-proxy]Fixed

    Source package: [xdg-dbus-proxy]

    Details (1)

    • 0.1.8-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 0.1.7-1.1

      nvd · xdg-dbus-proxy · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [xdg-dbus-proxy]Fixed
    Details (4)

    • 0.1.4-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 0.1.4-3+deb12u1

      nvd · xdg-dbus-proxy · debian · bookworm; nvd · xdg-dbus-proxy · debian · 12

    • 0.1.4-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 0.1.4-3+deb12u1

      nvd · xdg-dbus-proxy · debian · bookworm; nvd · xdg-dbus-proxy · debian · 12

    • 0.1.4-3+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 0.1.4-3+deb12u1

      nvd · xdg-dbus-proxy · debian · bookworm; nvd · xdg-dbus-proxy · debian · 12

    • 0.1.4-3+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 0.1.4-3+deb12u1

      nvd · xdg-dbus-proxy · debian · bookworm; nvd · xdg-dbus-proxy · debian · 12

  • [xdg-dbus-proxy-tests]Fixed

    Source package: [xdg-dbus-proxy]

    Details (4)

    • 0.1.4-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 0.1.4-3+deb12u1

      nvd · xdg-dbus-proxy · debian · bookworm; nvd · xdg-dbus-proxy · debian · 12

    • 0.1.4-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 0.1.4-3+deb12u1

      nvd · xdg-dbus-proxy · debian · bookworm; nvd · xdg-dbus-proxy · debian · 12

    • 0.1.4-3+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 0.1.4-3+deb12u1

      nvd · xdg-dbus-proxy · debian · bookworm; nvd · xdg-dbus-proxy · debian · 12

    • 0.1.4-3+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 0.1.4-3+deb12u1

      nvd · xdg-dbus-proxy · debian · bookworm; nvd · xdg-dbus-proxy · debian · 12

[Debian 13 (Trixie)]

  • [xdg-dbus-proxy]Fixed
    Details (6)

    • 0.1.6-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 0.1.6-1+deb13u1

      nvd · xdg-dbus-proxy · debian · 13

    • 0.1.6-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 0.1.6-1+deb13u1

      nvd · xdg-dbus-proxy · debian · 13

    • 0.1.6-1+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 0.1.6-1+deb13u1

      nvd · xdg-dbus-proxy · debian · 13

    • 0.1.6-1+deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 0.1.6-1+deb13u1

      nvd · xdg-dbus-proxy · debian · 13

    • 0.1.6-1+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 0.1.6-1+deb13u1

      nvd · xdg-dbus-proxy · debian · 13

    • 0.1.6-1+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 0.1.6-1+deb13u1

      nvd · xdg-dbus-proxy · debian · 13

  • [xdg-dbus-proxy-tests]Fixed

    Source package: [xdg-dbus-proxy]

    Details (6)

    • 0.1.6-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 0.1.6-1+deb13u1

      nvd · xdg-dbus-proxy · debian · 13

    • 0.1.6-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 0.1.6-1+deb13u1

      nvd · xdg-dbus-proxy · debian · 13

    • 0.1.6-1+deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 0.1.6-1+deb13u1

      nvd · xdg-dbus-proxy · debian · 13

    • 0.1.6-1+deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 0.1.6-1+deb13u1

      nvd · xdg-dbus-proxy · debian · 13

    • 0.1.6-1+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 0.1.6-1+deb13u1

      nvd · xdg-dbus-proxy · debian · 13

    • 0.1.6-1+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 0.1.6-1+deb13u1

      nvd · xdg-dbus-proxy · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]