{"id":"CVE-2026-34080","aliases":["AZL-81957","CLSA-2026-1789126805","CLSA-2026-1789132992","DEBIAN-CVE-2026-34080","EUVD-2026-19945","GHSA-vjp5-hjfm-7677","MGASA-2026-0178","OESA-2026-2212","OESA-2026-2213","OESA-2026-2214","OESA-2026-2286","OESA-2026-2287","SUSE-SU-2026:22096-1","SUSE-SU-2026:2755-1","UBUNTU-CVE-2026-34080","USN-8167-1","USN-8167-2","openSUSE-SU-2026:10625-1","openSUSE-SU-2026:20934-1"],"status":"published","title":"xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.","severity":{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00178,"percentile":0.07444,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1289"],"published":"2026-04-07T20:57:57Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"xdg-dbus-proxy","fixed_in":["0.1.3-1.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"xdg-dbus-proxy","fixed_in":["0.1.3-1.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xdg-dbus-proxy","fixed_in":["0.1.4-3+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xdg-dbus-proxy","fixed_in":["0.1.6-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xdg-dbus-proxy","fixed_in":["0.1.7-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"xdg-dbus-proxy","fixed_in":["0.1.7-1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"xdg-dbus-proxy","fixed_in":["0.1.2-2.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"xdg-dbus-proxy","fixed_in":["0.1.2-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"xdg-dbus-proxy","fixed_in":["0.1.2-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"xdg-dbus-proxy","fixed_in":["0.1.2-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"xdg-dbus-proxy","fixed_in":["0.1.2-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"xdg-dbus-proxy","fixed_in":["0.1.6-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"xdg-dbus-proxy","fixed_in":["0.1.6-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"xdg-dbus-proxy","fixed_in":["0.1.5-150600.3.5.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xdg-dbus-proxy","fixed_in":["0.1.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"xdg-dbus-proxy","fixed_in":["0.1.3-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"xdg-dbus-proxy","fixed_in":["0.1.5-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"xdg-dbus-proxy","fixed_in":["0.1.6-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"xdg-dbus-proxy","fixed_in":["0.1.7-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"xdg-dbus-proxy","fixed_in":["0.1.6-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.1.6-2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.3-1.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.3-1.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.4-3+deb12u1"}]}],"versions":["0.1.4-3"]},{"source":"osv","ecosystem":"Debian:13","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6-1+deb13u1"}]}],"versions":["0.1.6-1"]},{"source":"osv","ecosystem":"Debian:14","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.7-1"}]}],"versions":["0.1.6-1","0.1.6-2"]},{"source":"osv","ecosystem":"Mageia:9","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.7-1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-2.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.5-150600.3.5.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-1ubuntu0.1~esm1"}]}],"versions":["0.1.1-1","0.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.3-1ubuntu0.1"}]}],"versions":["0.1.2-2build1","0.1.3-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.5-1ubuntu0.2"}]}],"versions":["0.1.5-1","0.1.5-1build1","0.1.5-1build2","0.1.5-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6-1ubuntu0.1"}]}],"versions":["0.1.6-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.3-1ubuntu0.1"}]}],"versions":["0.1.2-2build1","0.1.3-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.5-1ubuntu0.2"}]}],"versions":["0.1.5-1","0.1.5-1build1","0.1.5-1build2","0.1.5-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6-1ubuntu0.1"}]}],"versions":["0.1.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-1ubuntu0.1~esm1"}]}],"versions":["0.1.1-1","0.1.2-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.7-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6-160000.3.1"}]}]}],"products":[{"vendor":"flatpak","product":"xdg-dbus-proxy"}],"references":[{"url":"https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-vjp5-hjfm-7677","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/10/15","tags":["Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/04/msg00022.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34080","tags":["web","advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1789126805.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1789132992.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34080.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34080","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0178.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35347","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/10/15","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2212","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2213","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2214","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2286","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2287","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622096-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261737","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34080","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262755-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-34080","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34080","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8167-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8167-2","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-34080","title":"xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.","status":"published","published":"2026-04-07T20:57:57.931Z","modified":"2026-04-21T12:21:20.635Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-1289"],"updated_at":"2026-11-02T14:20:14.665567Z"}],"euvd":[{"id":"EUVD-2026-19945","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.","status":"published","published":"2026-04-07T20:57:57Z","modified":"2026-04-21T12:21:20Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:24:22.012341Z"}],"nvd":[{"id":"CVE-2026-34080","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.","status":"published","published":"2026-04-07T21:17:17.72Z","modified":"2026-07-24T22:10:00.14Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-1289"],"updated_at":"2026-11-02T14:12:13.535987Z"}],"osv":[{"id":"CVE-2026-34080","title":"xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.","status":"published","published":"2026-04-07T20:57:57.931Z","modified":"2026-10-28T02:30:52.532211365Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1289"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"DEBIAN-CVE-2026-34080","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.","status":"published","published":"2026-04-07T21:17:17.72Z","modified":"2026-10-01T03:03:03.994744948Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"OESA-2026-2212","title":"xdg-dbus-proxy security update","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts.\r\n\r\nSecurity Fix(es):\n\nxdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop =\u0026apos;true\u0026apos; (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.(CVE-2026-34080)","status":"published","published":"2026-05-09T11:11:11Z","modified":"2026-08-18T01:19:51.867831318Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2213","title":"xdg-dbus-proxy security update","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts.\r\n\r\nSecurity Fix(es):\n\nxdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop =\u0026apos;true\u0026apos; (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.(CVE-2026-34080)","status":"published","published":"2026-05-09T11:11:11Z","modified":"2026-08-18T01:19:51.833079441Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2214","title":"xdg-dbus-proxy security update","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts.\r\n\r\nSecurity Fix(es):\n\nxdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop =\u0026apos;true\u0026apos; (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.(CVE-2026-34080)","status":"published","published":"2026-05-09T11:11:11Z","modified":"2026-08-18T01:19:51.794429758Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2286","title":"xdg-dbus-proxy security update","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts.\r\n\r\nSecurity Fix(es):\n\nxdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop =\u0026apos;true\u0026apos; (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.(CVE-2026-34080)","status":"published","published":"2026-05-15T11:11:15Z","modified":"2026-08-18T01:19:53.080467585Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2287","title":"xdg-dbus-proxy security update","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts.\r\n\r\nSecurity Fix(es):\n\nxdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop =\u0026apos;true\u0026apos; (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.(CVE-2026-34080)","status":"published","published":"2026-05-15T11:11:15Z","modified":"2026-08-18T01:19:53.046822411Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"UBUNTU-CVE-2026-34080","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.","status":"published","published":"2026-04-07T21:17:00Z","modified":"2026-05-27T16:59:13.728322903Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"AZL-81957","title":"CVE-2026-34080 affecting package xdg-dbus-proxy 0.1.6-2","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.","status":"published","published":"2026-04-07T21:17:17Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"CLSA-2026-1789126805","title":"xdg-dbus-proxy: Fix of CVE-2026-34080","description":"- Improve detection of eavesdrop=true in the D-Bus match-rule filter\n  to address the following vulnerability:\n- CVE-2026-34080: the eavesdrop= match was located with a fixed-string\n  search, so whitespace between 'eavesdrop' and '=' was not recognised\n  and a client could install an eavesdropping match rule that the proxy\n  was supposed to reject","status":"published","published":"2026-09-11T11:40:16Z","modified":"2026-10-26T09:31:35.683006336Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789132992","title":"xdg-dbus-proxy: Fix of CVE-2026-34080","description":"- Improve detection of eavesdrop=true in the D-Bus match-rule filter\n  to address the following vulnerability:\n- CVE-2026-34080: the eavesdrop= match was located with a fixed-string\n  search, so whitespace between 'eavesdrop' and '=' was not recognised\n  and a client could install an eavesdropping match rule that the proxy\n  was supposed to reject","status":"published","published":"2026-09-11T13:23:24Z","modified":"2026-10-26T09:30:45.349216141Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"MGASA-2026-0178","title":"Updated xdg-dbus-proxy packages fix security vulnerability","description":"A policy parser vulnerability allows bypassing eavesdrop restrictions.\nThe proxy checks for eavesdrop=true in policy rules but fails to handle\neavesdrop ='true' (with a space before the equals sign) and similar\ncases.\n","status":"published","published":"2026-06-07T05:10:04Z","modified":"2026-06-07T05:15:04.346641013Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10625-1","title":"xdg-dbus-proxy-0.1.7-1.1 on GA media","description":"These are all security issues fixed in the xdg-dbus-proxy-0.1.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-26T00:00:00Z","modified":"2026-04-27T08:15:31.218497Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20934-1","title":"Security update for xdg-dbus-proxy","description":"This update for xdg-dbus-proxy fixes the following issue:\n\n- CVE-2026-34080: failure in the policy parser can lead to information disclosure (bsc#1261737).\n","status":"published","published":"2026-06-10T14:52:15Z","modified":"2026-06-13T18:24:18.778035933Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22096-1","title":"Security update for xdg-dbus-proxy","description":"This update for xdg-dbus-proxy fixes the following issue:\n\n- CVE-2026-34080: failure in the policy parser can lead to information disclosure (bsc#1261737).\n","status":"published","published":"2026-06-10T14:52:26Z","modified":"2026-06-16T18:24:40.689839094Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2755-1","title":"Security update for xdg-dbus-proxy","description":"This update for xdg-dbus-proxy fixes the following issue:\n\n- CVE-2026-34080: failure in the policy parser can lead to information disclosure (bsc#1261737).\n","status":"published","published":"2026-07-03T19:24:13Z","modified":"2026-07-07T18:24:08.093155596Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8167-1","title":"xdg-dbus-proxy vulnerability","description":"It was discovered that xdg-dbus-proxy incorrectly handled eavesdropping\nin policy rules. A local attacker could possibly use this issue to\nintercept certain D-Bus messages.","status":"published","published":"2026-04-13T12:07:10Z","modified":"2026-04-27T18:47:52.269253Z","updated_at":"2026-11-02T16:58:22.951676Z"},{"id":"USN-8167-2","title":"xdg-dbus-proxy vulnerability","description":"USN-8167-1 fixed a vulnerability in xdg-dbus-proxy. This update\nprovides the corresponding update for Ubuntu 20.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that xdg-dbus-proxy incorrectly handled eavesdropping\n in policy rules. A local attacker could possibly use this issue to\n intercept certain D-Bus messages.","status":"published","published":"2026-05-26T18:25:50Z","modified":"2026-05-27T16:59:13.424463118Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}