Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
xdg-dbus-proxy D-Bus Message Eavesdropping Risk
published 5 months ago
Summary
The xdg-dbus-proxy software, used to control access to D-Bus messages, had a security flaw that allowed unauthorized clients to intercept sensitive information. This has been fixed in a recent update. To protect your system, update to the latest version of xdg-dbus-proxy.
What to do
- Update openeuler xdg-dbus-proxy to version 0.1.2-2.oe2203sp4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:22.03-LTS-SP4 | openeuler | xdg-dbus-proxy |
< 0.1.2-2.oe2203sp4 Fix: upgrade to 0.1.2-2.oe2203sp4
|
Original advisory text
xdg-dbus-proxy security update
xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts.
Security Fix(es):
xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.(CVE-2026-34080)
Security Fix(es):
xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.(CVE-2026-34080)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-34080 Vendor Advisory
Timeline
Published15 May 2026
Updated15 May 2026
First seen15 May 2026
Sources
OESA-2026-2287 · OSV
Track software like this
Free during beta