CVE-2026-128987
Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations
CVE-2026-128987 is a medium vulnerability (CVSS 6.2) in Red Hat Enterprise Linux 10, published November 13, 2026. No source lists public exploit code. No source names a fixed version.
- Severity
- 6.2 MediumCVSS 3.1, CVE List
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors as retryable, the application enters a continuous retry loop. This can lead to excessive CPU consumption, resulting in a denial of service (DoS) for the target process.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dbusDebian:12 | All versions, plus listed versions 1.14.10-11.14.10-1~deb12u11.14.10-21.14.10-31.14.10-4 Show 32 moreShow less1.14.10-51.14.10-61.14.6-11.14.8-11.14.8-1+loong641.14.8-1~deb12u11.14.8-21.14.8-2~deb12u11.14.99~git20220715-11.15.0-11.15.10-11.15.12-11.15.2-11.15.4-11.15.6-11.15.6-21.15.8-11.15.8-21.15.8-31.15.8-41.15.90-11.15.92-11.16.0-11.16.2-11.16.2-21.16.2-31.16.2-41.16.2-51.16.2-61.16.2-71.16.2-81.16.4-1 | None known |
dbusDebian:13 | All versions, plus listed versions 1.16.2-21.16.2-31.16.2-41.16.2-51.16.2-61.16.2-71.16.2-81.16.4-1 | None known |
dbusDebian:14 | All versions, plus listed versions 1.16.2-21.16.2-31.16.2-41.16.2-51.16.2-61.16.2-71.16.2-81.16.4-1 | None known |
What each source reports
CVE List Score used
Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations
A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors as retryable, the application enters a continuous retry loop. This can lead to excessive CPU consumption, resulting in a denial of service (DoS) for the target process.
- Record
CVE-2026-128987- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-13
EUVDEUVD-2026-125774
A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors as retryable, the application enters a continuous retry loop. This can lead to excessive CPU consumption, resulting in a denial of service (DoS) for the target process.
- Record
EUVD-2026-125774- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
GitHub AdvisoriesGHSA-4734-9v83-3gjc
A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an...
A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors as retryable, the application enters a continuous retry loop. This can lead to excessive CPU consumption, resulting in a denial of service (DoS) for the target process.
- Record
GHSA-4734-9v83-3gjc- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-13
NVD
A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors as retryable, the application enters a continuous retry loop. This can lead to excessive CPU consumption, resulting in a denial of service (DoS) for the target process.
- Record
CVE-2026-128987- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-13
OSVDEBIAN-CVE-2026-128987
- Record
DEBIAN-CVE-2026-128987- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-14
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD, NVD | |
| aliases | EUVD | |
| products, published, references, severity, title | CVE List | |
| affected, aliases, references | OSV | |
| first indexed | GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.