CVE-2026-128886
Description
A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial of Service (DoS) by opening a connection and withholding the expected authentication token. Because the server processes this verification without enforcing a timeout, the stalled connection blocks the accept process and prevents legitimate clients from establishing new connections.
Statement
This vulnerability is rated as Moderate severity rather than Important because default Red Hat Enterprise Linux installations configure D-Bus to listen exclusively on local UNIX domain sockets. Exploitation requires an administrator to explicitly configure and expose a non-standard nonce-tcp transport. In environments where this transport is active and reachable, an unauthenticated client can cause a denial of service by stalling the nonce verification phase and blocking incoming connections to that listener.
Mitigation
Disable non-standard `nonce-tcp` listeners in the D-Bus configuration in favor of standard UNIX domain sockets. If network reachability is required, restrict access to trusted hosts using `firewalld`.
To remove an exposed port from an untrusted firewall zone:
firewall-cmd --permanent --zone=public --remove-port=<PORT>/tcp
firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_SUBNET>
firewall-cmd --reload
Caveats:
Restricting or disabling network listeners prevents remote clients outside the trusted subnet from connecting to the affected bus.
Warning:
Reloading the firewall rules or altering the D-Bus server configuration requires restarting the affected D-Bus service, which will drop existing connections and temporarily disrupt communications.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.2 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
When an attacker can directly invoke the blocking code, or the blocking code can be affected by environmental conditions that can be influenced by an attacker, then this can lead to a denial of service by causing unexpected hang or freeze of the code. An unexpected call to blocking code can trigger an infinite loop, or a large loop that causes the software to pause and wait indefinitely.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
