CVE-2026-3836

[CVE catalog]

A flaw was found in dnf5. A local, unprivileged attacker can exploit a path traversal vulnerability in the D-Bus locale configuration. By providing a specially crafted string to the locale key during session opening, the attacker can force the dnf5daemon-server to terminate, leading to an application-level Denial of Service (DoS) with a core dump. dnf5: dnf5: Denial of Service via path traversal in D-Bus locale configuration This issue was rated as moderate. A path traversal vulnerability exists in dnf5daemon-server, allowing a local, unprivileged attacker with access to the System D-Bus to trigger a denial of service. By providing a specially crafted locale string during session opening, the attacker can force the daemon to terminate, leading to an application-level denial of service with a core dump. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Published

Jan 1, 1, 12:00:00 AM UTC

Updated

May 1, 2026, 8:00:34 PM UTC

Source

[NVD] · [CVE record]

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "dnf5",
      "distro": "debian",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.4.2.0-1"
            }
          ]
        }
      ],
      "release": "14",
      "versions": [
        "5.3.0.0-1",
        "5.3.0.0-2",
        "5.4.0.0-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-3836",
      "fixed_version": "5.4.2.0-1",
      "provider_source": "pypi",
      "provider_record_id": "DEBIAN-CVE-2026-3836",
      "provider_updated_at": "2026-05-01T20:00:34.484432Z",
      "applicability_unknown": true
    }
  ]
}