CVE-2026-15588: vLLM — MEDIUM

A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input...

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
92.7K 95 dependents Pushed 3d ago 26% patched ~47d to patch Full package profile →
vLLM	pip	—	No patch
92.7K 95 dependents Pushed 3d ago 26% patched ~47d to patch Full package profile →
cert-manager/cert-manager-istio-csr-rhel9	—	—	No patch
cert-manager/cert-manager-operator-rhel9	—	—	No patch
cert-manager/cert-manager-trust-manager-rhel9	—	—	No patch
cert-manager/jetstack-cert-manager-acmesolver-rhel9	—	—	No patch
cert-manager/jetstack-cert-manager-rhel9	—	—	No patch
discovery/discovery-server-rhel9	—	—	No patch
discovery/discovery-ui-rhel9	—	—	No patch
glib2	—	—	No patch
glib2-main	—	—	No patch
mingw-glib2	—	—	No patch
openshift/ose-rhel-coreos-8	—	—	No patch
openshift/ose-rhel-coreos-9	—	—	No patch
rhai/base-image-cpu-rhel9	—	—	No patch
rhai/base-image-cuda-rhel9	—	—	No patch
rhai/base-image-rocm-rhel9	—	—	No patch
rhai/base-image-spyre-rhel9	—	—	No patch
rhai/base-image-tpu-rhel9	—	—	No patch
rhaiis/model-opt-cuda-rhel9	—	—	No patch
rhui5/cds-kubernetes-rhel9	—	—	No patch
rhui5/cds-kubernetes-tp-rhel9	—	—	No patch
rhui5/cds-rhel9	—	—	No patch
rhui5/haproxy-rhel9	—	—	No patch
rhui5/installer-rhel9	—	—	No patch
rhui5/installer-tp-rhel9	—	—	No patch
rhui5/rhua-rhel9	—	—	No patch
rhui5/rhua-tp-rhel9	—	—	No patch

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

N/A

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

No patch available

Monitor for updates. Consider compensating controls or temporary mitigations.

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-15588?

A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.

Is CVE-2026-15588 actively exploited?

No confirmed active exploitation of CVE-2026-15588 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-15588?

No patch is currently available. Monitor vendor advisories for updates.

What is the CVSS score for CVE-2026-15588?

CVE-2026-15588 has a CVSS v3.1 base score of 5.3 (MEDIUM).

What are the technical details?

Original Advisory

A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.

Weaknesses (CWE)

CWE-770 Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.