{"answers":{"affected":"6 open source packages ship an affected version, including Tmds.DBus.Protocol and Tmds.DBus.","exploited":"There is no known exploitation of CVE-2026-39959 in the wild and no public exploit code.","fix":"Upgrade Tmds.DBus.Protocol to a fixed version for your release line: 0.21.3 or 0.92.0.","what":"CVE-2026-39959 is a high-severity denial of service vulnerability in Tmds.DBus, published on 9 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-39959 and fix it if it is affected.\n\nWhat it is: CVE-2026-39959 is a high-severity denial of service vulnerability in Tmds.DBus, published on 9 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-39959 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- Tmds.DBus.Protocol (NuGet): affected all versions; fixed in 0.21.3\n- Tmds.DBus.Protocol (NuGet): affected all versions; fixed in 0.21.3\n- Tmds.DBus.Protocol (NuGet): affected from 0.22.0; fixed in 0.92.0\n- Tmds.DBus.Protocol (NuGet): affected from 0.22.0; fixed in 0.92.0\n- Tmds.DBus (NuGet): affected all versions; fixed in 0.92.0\n- Tmds.DBus (NuGet): affected all versions; fixed in 0.92.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-39959/ (Markdown: https://insights.sbomify.com/CVE-2026-39959/index.md)","id":"CVE-2026-39959","markdown":"https://insights.sbomify.com/CVE-2026-39959/index.md","name":"CVE-2026-39959","record":{"aliases":["GHSA-xrw6-gwf8-vvr9"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service","security_bypass"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"D-Bus .NET library","requires_auth":"low_privilege","summary":"Malicious D-Bus peers can spoof signals, exhaust file descriptors, and crash applications via malformed messages in Tmds.DBus libraries.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"},{"id":"CWE-290","name":"Authentication Bypass by Spoofing"}],"description":"Tmds.DBus provides .NET libraries for working with D-Bus from .NET. Tmds.DBus and Tmds.DBus.Protocol are vulnerable to malicious D-Bus peers. A peer on the same bus can spoof signals by impersonating the owner of a well-known name, exhaust system resources or cause file descriptor spillover by sending messages with an excessive number of Unix file descriptors, and crash the application by sending malformed message bodies that cause unhandled exceptions on the SynchronizationContext. This vulnerability is fixed in Tmds.DBus 0.92.0 and Tmds.DBus.Protocol 0.92.0 and 0.21.3.","ecosystems":["NuGet"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service","id":"CVE-2026-39959","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"NuGet","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":6,"n_references":1,"next":{"headline":"MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Values","id":"CVE-2026-39960"},"packages":[{"ecosystem":"NuGet","fixed":["0.92.0"],"introduced":["0"],"last_affected":[],"package":"Tmds.DBus","purl":null,"source":"GHSA-xrw6-gwf8-vvr9"},{"ecosystem":"NuGet","fixed":["0.92.0"],"introduced":["0"],"last_affected":[],"package":"Tmds.DBus","purl":"pkg:nuget/Tmds.DBus","source":"GHSA-xrw6-gwf8-vvr9"},{"ecosystem":"NuGet","fixed":["0.21.3"],"introduced":["0"],"last_affected":[],"package":"Tmds.DBus.Protocol","purl":null,"source":"GHSA-xrw6-gwf8-vvr9"},{"ecosystem":"NuGet","fixed":["0.21.3"],"introduced":["0"],"last_affected":[],"package":"Tmds.DBus.Protocol","purl":"pkg:nuget/Tmds.DBus.Protocol","source":"GHSA-xrw6-gwf8-vvr9"},{"ecosystem":"NuGet","fixed":["0.92.0"],"introduced":["0.22.0"],"last_affected":[],"package":"Tmds.DBus.Protocol","purl":null,"source":"GHSA-xrw6-gwf8-vvr9"},{"ecosystem":"NuGet","fixed":["0.92.0"],"introduced":["0.22.0"],"last_affected":[],"package":"Tmds.DBus.Protocol","purl":"pkg:nuget/Tmds.DBus.Protocol","source":"GHSA-xrw6-gwf8-vvr9"}],"prev":{"headline":"oma-topic: name Field in Topic Manifests (topic.json) May Allow CRLF Injection","id":"CVE-2026-39958"},"products":["Tmds.DBus","Tmds.DBus.Protocol"],"published":"2026-04-09","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-04-09","vendors":["tmds"]},"summary":"Malicious D-Bus peers can spoof signals, exhaust file descriptors, and crash applications via malformed messages in Tmds.DBus libraries.","url":"https://insights.sbomify.com/CVE-2026-39959/"}