CVE-2026-128886 · Infrastructure
NO FIX YET
When dbus runs with the nonce-tcp transport, a connection that never sends its authentication token is not timed out. Such a connection blocks the accept loop so legitimate clients cannot connect.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only systems where dbus is configured with the nonce-tcp transport and its listener is reachable by an attacker. Default local-socket setups are not described as affected. The sources do not give version ranges.
Not affected if default-config, local-socket-only
Who cares dbus, linux, self-hosted
nonce-tcp transport in its dbus configuration files.dbus-daemon --version; the sources do not name affected or fixed versions.No fix yet, per the sources.
A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial of Service (DoS) by opening a connection and withholding the expected authentication token. Because the server processes this verification without enforcing a timeout, the stalled connection blocks the accept process and prevents legitimate clients from establishing new connections.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.