PT-2026-25531 · Dnf5 · Dnf5

Published 2026-01-01 · Updated 2026-03-26 · CVE-2026-3836

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions dnf5 (affected versions not specified)

Description The package manager's D-Bus interface, which runs with root privileges and is always active, is susceptible to a crash when processed with an invalid locale. This issue allows for a denial of service without requiring authentication.

Recommendations Upgrade dnf5 to the latest version.

Related Identifiers

CVE-2026-3836

RHSA-2026:7349

Affected Products

Dnf5

References · 7

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3836 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-3836 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-3836 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-3836 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-3836 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2445770 · Note
• https://twitter.com/geeknik/status/2032929868111884323 · Twitter Post