Advisory Database
  • Advisories
  • Dependency Scanning
  1. nuget
  2. ›
  3. Tmds.DBus
  4. ›
  5. GHSA-xrw6-gwf8-vvr9

GHSA-xrw6-gwf8-vvr9: Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service

April 8, 2026

Tmds.DBus and Tmds.DBus.Protocol are vulnerable to malicious D-Bus peers. A peer on the same bus can spoof signals by impersonating the owner of a well-known name, exhaust system resources or cause file descriptor spillover by sending messages with an excessive number of Unix file descriptors, and crash the application by sending malformed message bodies that cause unhandled exceptions on the SynchronizationContext.

References

  • github.com/advisories/GHSA-xrw6-gwf8-vvr9
  • github.com/tmds/Tmds.DBus
  • github.com/tmds/Tmds.DBus/releases/tag/rel%2F0.21.3
  • github.com/tmds/Tmds.DBus/releases/tag/rel%2F0.92.0
  • github.com/tmds/Tmds.DBus/security/advisories/GHSA-xrw6-gwf8-vvr9

Code Behaviors & Features

Detect and mitigate GHSA-xrw6-gwf8-vvr9 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.92.0

Fixed versions

  • 0.92.0

Solution

Upgrade to version 0.92.0 or above.

Impact 7.1 HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-400: Uncontrolled Resource Consumption

Source file

nuget/Tmds.DBus/GHSA-xrw6-gwf8-vvr9.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Thu, 09 Apr 2026 12:19:44 +0000.