C23/100
Vulnerability · medium
dbus 1.16.4 fixes multiple denial-of-service issues
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Systems running dbus earlier than 1.16.4
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
Popular tool · No fix yet
What to do
- Upgrade dbus to 1.16.4
The Brief
- dbus 1.16.4 was released with fixes for several denial-of-service issues.
- A further local denial-of-service issue, dbus#589, is known and not yet fixed.
- CVE IDs have been requested from Red Hat's CNA and were not yet allocated at publication.
Why it matters
Systems running dbus can be made unavailable by these denial-of-service issues, so upgrading to 1.16.4 closes the fixed ones. dbus#589 remains open in this release.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Judgment: dbus is a system IPC component on Linux, which developers and ops teams run and maintain. |
| No | Core infrastructure | Judgment: dbus is ubiquitous on Linux but is a system IPC daemon, not one of the listed core infrastructure packages. |
| Yes | Popular tool | Judgment: dbus is a widely deployed system component on mainstream Linux distributions. |
| No | Exploited in the wild | oss-sec (2026-11-12) only announces DoS fixes in the 1.16.4 release; no observed attacks reported. |
| No | Public exploit | oss-sec (2026-11-12) describes release fixes only; no exploit code or PoC mentioned. |
| No | Remote, no login | oss-sec (2026-11-12) describes local denial-of-service issues, not unauthenticated network attacks. |
| No | Full takeover | oss-sec (2026-11-12) describes denial-of-service issues only; no code execution or privilege escalation reported. |
| No | Secrets exposed | oss-sec (2026-11-12) reports denial-of-service fixes; no data exposure mentioned. |
| No | Supply chain | oss-sec (2026-11-12) reports ordinary bug fixes in a legitimate release; no malicious code involved. |
| Yes | No fix yet | oss-sec (2026-11-12): another local denial of service, dbus#589, is known and not yet fixed. |
Timeline
dbus 1.16.4 released with fixes for multiple denial-of-service issues, disclosed on oss-sec
Open Source Security
dbus: multiple denial-of-service issues
Source
dbus: multiple denial-of-service issues ↗ Open Source Security · 2h ago
First seen · 1 source · Full story page · How tiers are decided