{"id":"CVE-2026-16730","aliases":["ALSA-2026:61340","ALSA-2026:61355","CLSA-2026-1788817207","CLSA-2026-1791316945","DEBIAN-CVE-2026-16730","EUVD-2026-48559","GHSA-77qf-9j4m-ph58","RHSA-2026:61340","RHSA-2026:61355","RLSA-2026:61340","RLSA-2026:61355","UBUNTU-CVE-2026-16730"],"status":"published","title":"Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup","description":"A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00154,"percentile":0.04589,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-755"],"published":"2026-07-24T11:26:18Z","modified":"2026-11-05T19:24:16Z","fixes":[{"ecosystem":"AlmaLinux:10","package":"dbus-broker","fixed_in":["36-5.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"dbus-broker","fixed_in":["28-9.el9_8"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"dbus-broker","fixed_in":["28-7.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"dbus-broker","fixed_in":["28-7.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"dbus-broker","fixed_in":["0:36-5.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"dbus-broker-debuginfo","fixed_in":["0:36-5.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"dbus-broker-debugsource","fixed_in":["0:36-5.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"dbus-broker","fixed_in":["0:28-9.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"dbus-broker-debuginfo","fixed_in":["0:28-9.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"dbus-broker-debugsource","fixed_in":["0:28-9.el9_8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"dbus-broker","fixed_in":["0:36-5.el10_2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"dbus-broker","fixed_in":["0:28-9.el9_8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"dbus-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"36-5.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dbus-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28-9.el9_8"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"dbus-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28-7.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"dbus-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28-7.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dbus-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["33-1","34-1","35-1","35-1~bpo12+1","35-2","36-1","36-1~bpo12+1","36-2","36-2~bpo12+1","37-1","37-2","37-2~bpo12+1","37-3","37-4","37-5"]},{"source":"osv","ecosystem":"Debian:13","package":"dbus-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["37-2","37-3","37-4","37-5"]},{"source":"osv","ecosystem":"Debian:14","package":"dbus-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["37-2","37-3","37-4","37-5"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dbus-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:36-5.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dbus-broker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:36-5.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dbus-broker-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:36-5.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"dbus-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:28-9.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"dbus-broker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:28-9.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"dbus-broker-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:28-9.el9_8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"dbus-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:36-5.el10_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"dbus-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:28-9.el9_8"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dbus-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["29-1","29-3","29-4","29-4build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dbus-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["33-1ubuntu1","35-2","35-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dbus-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["37-2","37-3","37-4","37-5"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"},{"vendor":"red hat","product":"red hat update infrastructure 5"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:61340","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61355","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66018","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16730","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506348","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/bus1/dbus-broker/issues/435","tags":["article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16730","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-77qf-9j4m-ph58"},{"url":"https://bugzilla.redhat.com/2506348","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-61340.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-61355.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1788817207.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791316945.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-16730","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61340.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16730","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61355.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:61340","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:61355","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-16730","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-16730","title":"Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup","description":"A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.","status":"published","published":"2026-07-24T11:26:18.978Z","modified":"2026-11-05T19:24:16.761Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-755"],"updated_at":"2026-11-05T20:54:59.423743Z"}],"euvd":[{"id":"EUVD-2026-48559","description":"A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.","status":"published","published":"2026-07-24T11:26:18Z","modified":"2026-11-05T19:24:16Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T20:01:48.21368Z"}],"ghsa":[{"id":"GHSA-77qf-9j4m-ph58","title":"A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE...","description":"A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.","status":"published","published":"2026-07-24T12:30:53Z","modified":"2026-09-10T18:33:08Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T15:11:43.240477Z"}],"nvd":[{"id":"CVE-2026-16730","description":"A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.","status":"published","published":"2026-07-24T12:16:47.717Z","modified":"2026-11-05T20:17:51.18Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-755"],"updated_at":"2026-11-05T21:56:41.836249Z"}],"osv":[{"id":"DEBIAN-CVE-2026-16730","description":"A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.","status":"published","published":"2026-07-24T12:16:47.717Z","modified":"2026-10-01T03:02:52.47031155Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:52.562592Z"},{"id":"RHSA-2026:61340","title":"Red Hat Security Advisory: dbus-broker security update","status":"published","published":"2026-09-01T10:28:18Z","modified":"2026-09-11T10:13:31Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61355","title":"Red Hat Security Advisory: dbus-broker security update","status":"published","published":"2026-09-01T10:28:21Z","modified":"2026-09-11T10:13:32Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RLSA-2026:61340","title":"Moderate: dbus-broker security update","description":"dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features provided by recent Linux kernel releases.\n\nSecurity Fix(es):\n\n* dbus-broker: dbus-broker: session bus denial of service via EMFILE during peer setup (CVE-2026-16730)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-01T12:09:39.323272Z","modified":"2026-09-01T12:30:02.52828468Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:61355","title":"Moderate: dbus-broker security update","description":"dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features provided by recent Linux kernel releases.\n\nSecurity Fix(es):\n\n* dbus-broker: dbus-broker: session bus denial of service via EMFILE during peer setup (CVE-2026-16730)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-01T06:05:33.619213Z","modified":"2026-09-01T06:30:02.742829285Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-16730","description":"A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.","status":"published","published":"2026-07-24T12:16:00Z","modified":"2026-10-22T23:20:04.048742097Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"ALSA-2026:61340","title":"Moderate: dbus-broker security update","description":"dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features provided by recent Linux kernel releases.  \n\nSecurity Fix(es):  \n\n  * dbus-broker: dbus-broker: session bus denial of service via EMFILE during peer setup (CVE-2026-16730)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-31T00:00:00Z","modified":"2026-10-29T11:30:48.594259808Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:61355","title":"Moderate: dbus-broker security update","description":"dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features provided by recent Linux kernel releases.  \n\nSecurity Fix(es):  \n\n  * dbus-broker: dbus-broker: session bus denial of service via EMFILE during peer setup (CVE-2026-16730)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-31T00:00:00Z","modified":"2026-10-29T11:32:24.880559306Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"CLSA-2026-1788817207","title":"dbus-broker: Fix of CVE-2026-16730","description":"- CVE-2026-16730: bump RLIMIT_NOFILE to hard limit at broker startup to prevent\n  fatal EMFILE during peer setup (DoS)","status":"published","published":"2026-09-07T21:40:18Z","modified":"2026-10-26T09:30:44.59981131Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1791316945","title":"dbus-broker: Fix of CVE-2026-16730","description":"- CVE-2026-16730: bump RLIMIT_NOFILE to the hard limit at startup. This raises the\n  session bus file-descriptor headroom from 1024 to 524288; the system unit sets a\n  single LimitNOFILE=16384, so soft equals hard there and the bump is a no-op.\n  accept4() in src/bus/listener.c still treats EMFILE/ENFILE as fatal, as upstream does.","status":"published","published":"2026-10-06T20:02:37Z","modified":"2026-10-26T09:31:36.702574432Z","updated_at":"2026-11-02T15:43:49.016976Z"}]}}