State Confusion Flaw in GLib Affecting D-Bus Introspection
CVE-2026-58016

7.5HIGH

Key Information:

Vendor

Gnome
Status
Glib
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Vendor
CVE Published:
30 June 2026

What is CVE-2026-58016?

A state confusion issue has been identified in GLib, particularly in the function g_dbus_node_info_new_for_xml() found in gio/gdbusintrospection.c. This vulnerability arises when processing malformed D-Bus introspection XML with a element incorrectly nested within elements like , , , or . Such a misconfiguration can result in an unsigned integer overflow, potentially allowing for an out-of-bounds read, which may ultimately lead to a denial of service.

Affected Version(s)

Cert Manager support for Red Hat OpenShift release 1.17 1791371080

Cert Manager support for Red Hat OpenShift release 1.17 1791371069

Cert Manager support for Red Hat OpenShift release 1.17 1791788287

References

https://access.redhat.com/errata/RHSA-2026:42063
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42089
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42090
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank linhlhq for reporting this issue.
.