CVE-2026-128886
Dbus: server accept watch can be stalled by blocking nonce-tcp accept_with_noncefile path
- Medium 6.2
Description
A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial of Service (DoS) by opening a connection and withholding the expected authentication token. Because the server processes this verification without enforcing a timeout, the stalled connection blocks the accept process and prevents legitimate clients from establishing new connections.
Key facts
- Published
- 13 Nov 2026
- Last changed
- 13 Nov 2026
- Assigned by
- redhat
- EPSS
- 0.129% likely to be exploited in the next 30 days, higher than 2.559% of CVEs (scores for 15 Nov 2026)
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 6.2CVSS 3.1, Mediumfrom the CNA (redhat)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
What to do
- Disable non-standard `nonce-tcp` listeners in the D-Bus configuration in favor of standard UNIX domain sockets. If network reachability is required, restrict access to trusted hosts using `firewalld`. To remove an exposed port from an untrusted firewall zone: ``` firewall-cmd --permanent --zone=public --remove-port=<PORT>/tcp firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_SUBNET> firewall-cmd --reload ``` Caveats: Restricting or disabling network listeners prevents remote clients outside the trusted subnet from connecting to the affected bus. Warning: Reloading the firewall rules or altering the D-Bus server configuration requires restarting the affected D-Bus service, which will drop existing connections and temporarily disrupt communications.CNA workaround statement
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
|
Timeline
- 11 May 2026 Reported to Red Hat.
- 19 Aug 2026 Made public.
- 13 Nov 2026 Published