{"id":"CVE-2026-128987","kind":"vulnerability","aliases":["CVE-2026-128987"],"related":[],"title":"dbus: a local client can spin a service into a CPU-burning retry loop","description":"A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors as retryable, the application enters a continuous retry loop. This can lead to excessive CPU consumption, resulting in a denial of service (DoS) for the target process.","summary":"A flaw in dbus's socket transport treats broken pipe write errors as retryable, so a local client that stops reading while keeping its connection open makes the target process loop continuously. The result is excessive CPU use and a denial of service for that process.","severity":"medium","cvss":6.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dbus","infrastructure","linux","local-services"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T21:17:45+00:00","first_seen_at":"2026-11-13T21:33:41+00:00","triaged_at":"2026-11-13T21:33:50+00:00","updated_at":"2026-11-13T21:33:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-13T21:33:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"dbus: a local client can spin a service into a CPU-burning retry loop","impact":"low","summary":"A flaw in dbus's socket transport treats broken pipe write errors as retryable, so a local client that stops reading while keeping its connection open makes the target process loop continuously. The result is excessive CPU use and a denial of service for that process.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["dbus","linux","local-services"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Target process burns CPU continuously, causing denial of service","analyst_note":"Find the fixed dbus versions and affected service list from the NVD entry or upstream dbus advisory.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Only local users or processes that can connect to an affected dbus service can trigger this, so the exposure is on machines where untrusted local code can reach the bus. The sources do not name the affected dbus versions or which services are most exposed. Systems where only trusted local users run software are lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000684,"input_tokens":4554,"output_tokens":457,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128987':18A,21A '-2026':17A,20A 'affect':91C 'applic':117C 'attack':82C 'broken':36B,110C 'burn':13A 'client':4A,45B 'connect':52B,88C,103C 'consumpt':129C 'continu':59B,120C 'cpu':12A,64B,128C 'cpu-burn':11A 'cve':16A,19A 'dbus':1A,22B,31B,79C 'denial':68B,133C 'dos':136C 'enter':118C 'error':39B,113C 'excess':63B,127C 'exploit':84C 'flaw':29B,75C 'found':77C 'handl':109C 'infrastructur':23B 'keep':50B,101C 'lead':125C 'linux':24B 'local':3A,26B,44B,81C 'local-servic':25B 'loop':15A,58B,122C 'make':54B 'open':53B,104C 'pipe':37B,111C 'process':57B,73B,140C 'read':48B,99C 'request':93C 'respons':95C 'result':61B,130C 'retri':14A,121C 'retryabl':41B,115C 'servic':8A,27B,70B,92C,135C 'socket':33B,98C,107C 'spin':6A 'stop':47B,97C 'target':56B,139C 'transport':34B,108C 'treat':35B 'use':65B 'vulner':86C 'write':38B,112C","nicknames":[],"mitigations":[],"who_affected":"Only local users or processes that can connect to an affected dbus service can trigger this, so the exposure is on machines where untrusted local code can reach the bus. The sources do not name the affected dbus versions or which services are most exposed. Systems where only trusted local users run software are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dbus","infrastructure","linux","localservices","medium"],"campaign_type":null,"search_a":"'-128987':18A,21A '-2026':17A,20A 'burn':13A 'client':4A 'cpu':12A 'cpu-burn':11A 'cve':16A,19A 'dbus':1A 'local':3A 'loop':15A 'retri':14A 'servic':8A 'spin':6A","search_b":"'broken':36B 'client':45B 'connect':52B 'continu':59B 'cpu':64B 'dbus':22B,31B 'denial':68B 'error':39B 'excess':63B 'flaw':29B 'infrastructur':23B 'keep':50B 'linux':24B 'local':26B,44B 'local-servic':25B 'loop':58B 'make':54B 'open':53B 'pipe':37B 'process':57B,73B 'read':48B 'result':61B 'retryabl':41B 'servic':27B,70B 'socket':33B 'stop':47B 'target':56B 'transport':34B 'treat':35B 'use':65B 'write':38B","search_c":"'affect':91C 'applic':117C 'attack':82C 'broken':110C 'connect':88C,103C 'consumpt':129C 'continu':120C 'cpu':128C 'dbus':79C 'denial':133C 'dos':136C 'enter':118C 'error':113C 'excess':127C 'exploit':84C 'flaw':75C 'found':77C 'handl':109C 'keep':101C 'lead':125C 'local':81C 'loop':122C 'open':104C 'pipe':111C 'process':140C 'read':99C 'request':93C 'respons':95C 'result':130C 'retri':121C 'retryabl':115C 'servic':92C,135C 'socket':98C,107C 'stop':97C 'target':139C 'transport':108C 'vulner':86C 'write':112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T21:17:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128987","severity":null,"published_at":"2026-11-13T21:17:45+00:00","modified_at":"2026-11-13T21:17:46+00:00","first_seen_at":"2026-11-13T21:33:41+00:00","fetched_at":"2026-11-13T21:33:41+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}