Moderate Vulnerability in dbus-broker: Session Bus Denial of Service Risk
Summary
RLSA-2026:61340: Moderate: dbus-broker security update. Affects dbus-broker versions < 0:36-5.el10_2. Fixed in 0:36-5.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dbus-broker is a high-performance message bus implementation designed for Linux systems, adhering to the D-Bus specification. It aims to provide reliability and compatibility with the D-Bus reference implementation while leveraging modern Linux kernel features. This package is essential for inter-process communication on Linux, allowing applications to communicate with one another efficiently.
Vulnerability Detail
The vulnerability identified as CVE-2026-16730 in dbus-broker allows for a denial of service attack during the peer setup phase due to the EMFILE error. This can occur when the system reaches its limit for open file descriptors, leading to potential service interruptions. The impact of this vulnerability is significant as it can render the session bus inoperable, affecting all applications relying on dbus-broker for communication.
How To Fix
Minimum fixed version
0:36-5.el10_2
This is the first release that contains the fix.
sudo dnf update dbus-brokerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider increasing the limit of open file descriptors on your system. This can be done by modifying the limits in the '/etc/security/limits.conf' file. For example, you can add the following lines: 'your_username soft nofile 4096' and 'your_username hard nofile 8192'. Replace 'your_username' with your actual username.
Conclusion
The dbus-broker package has a moderate vulnerability (CVE-2026-16730) that can lead to denial of service. Users are advised to update to the patched version to mitigate this risk. Additionally, temporary workarounds are available to help manage the issue until the update can be applied.
See every vulnerability recorded for dbus-broker →
FAQ
dbus-broker is a message bus implementation for Linux that facilitates communication between applications using the D-Bus protocol.
CVE-2026-16730 refers to a specific vulnerability in dbus-broker that can lead to a denial of service due to the EMFILE error during peer setup.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.5, indicating a moderate level of risk.
It is recommended to regularly check for updates and apply them promptly to minimize the risk of vulnerabilities in your software.
Related vulnerabilities
Recent vulnerabilities recorded for dbus-broker.
