CVE catalog

CVE-2026-58015

A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A maliciou

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.84% · Oct 25, 2026

A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianglib2.0sid2.90.1-2fixed
Debianglib2.0forky2.90.1-2fixed
Debianglib2.0trixie2.84.4-3~deb13u5fixed
Debianglib2.0bookworm2.74.6-2+deb12u9vulnerable
Debianglib2.0bookworm-security2.74.6-2+deb12u2vulnerable
Cpeglib2.0Not reportedNot reportedvulnerable
CpeglibNot reported2.88.1fixed
Cpeenterprise_linuxNot reportedNot reportedunknown
CpeglibNot reported2.88.1fixed
Cpeenterprise_linuxNot reportedNot reportedunknown
Ubuntuglib2.0noble2.80.0-6ubuntu3.9fixed
Ubuntugir1.2-girepository-3.0noble2.80.0-6ubuntu3.9fixed
Ubuntugir1.2-girepository-3.0-devnoble2.80.0-6ubuntu3.9fixed
Ubuntugir1.2-glib-2.0noble2.80.0-6ubuntu3.9fixed
Ubuntugir1.2-glib-2.0-devnoble2.80.0-6ubuntu3.9fixed
Ubuntulibgirepository-2.0-0noble2.80.0-6ubuntu3.9fixed
Ubuntulibgirepository-2.0-devnoble2.80.0-6ubuntu3.9fixed
Ubuntulibglib2.0-0t64noble2.80.0-6ubuntu3.9fixed
Ubuntulibglib2.0-binnoble2.80.0-6ubuntu3.9fixed
Ubuntulibglib2.0-datanoble2.80.0-6ubuntu3.9fixed
Ubuntulibglib2.0-devnoble2.80.0-6ubuntu3.9fixed
Ubuntulibglib2.0-dev-binnoble2.80.0-6ubuntu3.9fixed
Ubuntulibglib2.0-docnoble2.80.0-6ubuntu3.9fixed
Ubuntulibglib2.0-testsnoble2.80.0-6ubuntu3.9fixed
Ubuntuglib2.0pro2.62.1-1vulnerable
Ubuntuglib2.0pro2.63.1-2vulnerable
Ubuntuglib2.0pro2.63.1-2ubuntu1vulnerable
Ubuntuglib2.0pro2.63.3-1vulnerable
Ubuntuglib2.0pro2.63.3-3vulnerable
Ubuntuglib2.0pro2.63.5-2vulnerable
Ubuntuglib2.0pro2.64.0-1vulnerable
Ubuntuglib2.0pro2.64.1-1vulnerable
Ubuntuglib2.0pro2.64.2-1~fakesync1vulnerable
Ubuntuglib2.0pro2.64.3-1~ubuntu20.04.1vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.1vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.2vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.3vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.4vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.6vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.7vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.8vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.9vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.9+esm1vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.9+esm2fixed
Ubuntuglib2.022.042.68.4-1ubuntu1vulnerable
Ubuntuglib2.022.042.70.1-1vulnerable
Ubuntuglib2.022.042.70.2-1vulnerable
Ubuntuglib2.022.042.71.0-2vulnerable
Ubuntuglib2.022.042.71.1-1vulnerable
Ubuntuglib2.022.042.71.2-1vulnerable
Ubuntuglib2.022.042.71.3-1vulnerable
Ubuntuglib2.022.042.72.0-1vulnerable
Ubuntuglib2.022.042.72.1-1vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu1vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.2vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.3vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.4vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.5vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.6vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.7vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.8vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.9vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.10fixed
Ubuntuglib2.024.042.78.0-2vulnerable
Ubuntuglib2.024.042.78.1-4vulnerable
Ubuntuglib2.024.042.78.3-1vulnerable
Ubuntuglib2.024.042.78.3-2vulnerable
Ubuntuglib2.024.042.79.1-1vulnerable
Ubuntuglib2.024.042.79.2-1~ubuntu1vulnerable
Ubuntuglib2.024.042.79.3-3ubuntu5vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu1vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.1vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.2vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.4vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.5vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.6vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.7vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.8vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.9fixed
Ubuntuglib2.025.102.84.1-1vulnerable
Ubuntuglib2.025.102.84.1-2vulnerable
Ubuntuglib2.025.102.84.2-1vulnerable
Ubuntuglib2.025.102.84.3-1vulnerable
Ubuntuglib2.025.102.85.1-2vulnerable
Ubuntuglib2.025.102.85.2-2vulnerable
Ubuntuglib2.025.102.85.3-1vulnerable
Ubuntuglib2.025.102.86.0-2vulnerable
Ubuntuglib2.025.102.86.0-2ubuntu0.1vulnerable
Ubuntuglib2.025.102.86.0-2ubuntu0.2vulnerable
Ubuntuglib2.025.102.86.0-2ubuntu0.3vulnerable
Ubuntuglib2.026.042.86.0-2vulnerable
Ubuntuglib2.026.042.86.1-1vulnerable
Ubuntuglib2.026.042.86.1-2vulnerable
Ubuntuglib2.026.042.86.2-1vulnerable
Ubuntuglib2.026.042.86.3-1vulnerable
Ubuntuglib2.026.042.86.3-4vulnerable
Ubuntuglib2.026.042.87.2-2vulnerable
Ubuntuglib2.026.042.87.2-3vulnerable
Ubuntuglib2.026.042.87.3-1vulnerable
Ubuntuglib2.026.042.88.0-1vulnerable
Ubuntuglib2.026.042.88.0-1ubuntu0.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianglib2.0sourcesid2.88.1-2not yet assignedNot reportedNot reported
Debianglib2.0sourceforky2.88.1-2not yet assignedNot reportedNot reported
Debianglib2.0sourcetrixie2.84.4-3~deb13u4not yet assignedNot reportedNot reported
Debianglib2.0sourcebookworm(unfixed)not yet assignedNot reportedNot reported
CpeglibcpeNot reported2.88.1Not reportedNot reportedNot reported
CpeglibcpeNot reported2.88.1Not reportedNVD-CVE-2026-58015Not reported
Ubuntuglib2.0debnoble2.80.0-6ubuntu3.9Not reportedNot reportedNot reported
Ubuntugir1.2-girepository-3.0debnoble2.80.0-6ubuntu3.9Not reportedNot reportedNot reported
Ubuntugir1.2-girepository-3.0-devdebnoble2.80.0-6ubuntu3.9Not reportedNot reportedNot reported
Ubuntugir1.2-glib-2.0debnoble2.80.0-6ubuntu3.9Not reportedNot reportedNot reported
Ubuntugir1.2-glib-2.0-devdebnoble2.80.0-6ubuntu3.9Not reportedNot reportedNot reported
Ubuntulibgirepository-2.0-0debnoble2.80.0-6ubuntu3.9Not reportedNot reportedNot reported
Ubuntulibgirepository-2.0-devdebnoble2.80.0-6ubuntu3.9Not reportedNot reportedNot reported
Ubuntulibglib2.0-0t64debnoble2.80.0-6ubuntu3.9Not reportedNot reportedNot reported
Ubuntulibglib2.0-bindebnoble2.80.0-6ubuntu3.9Not reportedNot reportedNot reported
Ubuntulibglib2.0-datadebnoble2.80.0-6ubuntu3.9Not reportedNot reportedNot reported
Ubuntulibglib2.0-devdebnoble2.80.0-6ubuntu3.9Not reportedNot reportedNot reported
Ubuntulibglib2.0-dev-bindebnoble2.80.0-6ubuntu3.9Not reportedNot reportedNot reported
Ubuntulibglib2.0-docdebnoble2.80.0-6ubuntu3.9Not reportedNot reportedNot reported
Ubuntulibglib2.0-testsdebnoble2.80.0-6ubuntu3.9Not reportedNot reportedNot reported
Ubuntuglib2.0debpro2.64.6-1~ubuntu20.04.9+esm2Not reportedUBUNTU-CVE-2026-58015Not reported
Ubuntuglib2.0deb22.042.72.4-0ubuntu2.10Not reportedUBUNTU-CVE-2026-58015Not reported
Ubuntuglib2.0deb24.042.80.0-6ubuntu3.9Not reportedUBUNTU-CVE-2026-58015Not reported
Ubuntuglib2.0deb26.042.88.0-1ubuntu0.1Not reportedUBUNTU-CVE-2026-58015Not reported

Notes

[bookworm] glib2.0: Minor issue; DBUS_COOKIE_SHA1 client path traversal, needs malicious D-Bus server

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libglib2.0-0]Affected

    Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · amd64 · bookworm

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · arm64 · bookworm

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · amd64 · bookworm-security

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · arm64 · bookworm-security

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

  • [libglib2.0-bin]Affected

    Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · amd64 · bookworm

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · arm64 · bookworm

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · amd64 · bookworm-security

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · arm64 · bookworm-security

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

  • [libglib2.0-data]Affected

    Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · all · bookworm

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · all · bookworm

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · all · bookworm-security

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · all · bookworm-security

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

  • [libglib2.0-dev]Affected

    Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · amd64 · bookworm

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · arm64 · bookworm

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · amd64 · bookworm-security

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · arm64 · bookworm-security

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

  • Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · amd64 · bookworm

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · arm64 · bookworm

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · amd64 · bookworm-security

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · arm64 · bookworm-security

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

  • [libglib2.0-doc]Affected

    Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · all · bookworm

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · all · bookworm

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · all · bookworm-security

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · all · bookworm-security

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

  • Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · amd64 · bookworm

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · arm64 · bookworm

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · amd64 · bookworm-security

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · arm64 · bookworm-security

      Affected

      nvd · glib2.0 · debian · bookworm; nvd · glib2.0 · debian · 12

[Debian 13 (Trixie)]

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

  • [gir1.2-glib-2.0]Affected

    Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

  • [libgio-2.0-dev]Affected

    Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

  • [libglib2.0-0t64]Affected

    Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

  • [libglib2.0-bin]Affected

    Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

  • [libglib2.0-data]Affected

    Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · all · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · all · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

  • [libglib2.0-dev]Affected

    Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Affected · Fixed: 2.84.4-3~deb13u4

      nvd · glib2.0 · debian · 13

Next results

Observed:

References