diff --git a/CVE-2026-58015.patch b/CVE-2026-58015.patch
new file mode 100644
index 0000000..187c141
--- /dev/null
+++ b/CVE-2026-58015.patch
@@ -0,0 +1,74 @@
+From 2f486f021aa46d172c7c7e8eef60dc7e22ad49f2 Mon Sep 17 00:00:00 2001
+From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
+Date: Mon, 20 Jul 2026 07:02:12 +0000
+Subject: [PATCH] gdbusauthmechanismsha1: Validate cookie context
+
+Without validation, the server could send a malicious context which
+contains path traversal characters, allowing it to exfiltrate a SHA-1
+hashed copy of arbitrary data from the client's file system.
+
+To exploit this successfully would require the client to choose to
+connect peer-to-peer to a malicious D-Bus server and to choose the SHA-1
+authentication mechanism in preference to all the other mechanisms. This
+is vanishingly unlikely.
+
+Signed-off-by: Philip Withnall <pwithnall@gnome.org>
+
+Fixes: #3931
+---
+ gio/gdbusauthmechanismsha1.c | 35 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 35 insertions(+)
+
+diff --git a/gio/gdbusauthmechanismsha1.c b/gio/gdbusauthmechanismsha1.c
+index 0cbaf946d..85fb5edc8 100644
+--- a/gio/gdbusauthmechanismsha1.c
++++ b/gio/gdbusauthmechanismsha1.c
+@@ -1130,6 +1130,34 @@ initial_response = _g_dbus_win32_get_user_sid ();
+   return initial_response;
+ }
+ 
++/* Context names must be valid ASCII, nonzero length, and may not contain the
++ * characters slash ("/"), backslash ("\"), space (" "), newline ("\n"),
++ * carriage return ("\r"), tab ("\t"), or period (".").
++ *
++ * See https://dbus.freedesktop.org/doc/dbus-specification.html#auth-mechanisms-sha */
++static gboolean
++validate_cookie_context (const char *cookie_context)
++{
++  size_t i = 0;
++
++  g_return_val_if_fail (cookie_context != NULL, FALSE);
++
++  for (i = 0; cookie_context[i] != '\0'; i++)
++    {
++      if ((guint8) cookie_context[i] >= 128 ||
++          cookie_context[i] == '/' ||
++          cookie_context[i] == '\\' ||
++          cookie_context[i] == ' ' ||
++          cookie_context[i] == '\n' ||
++          cookie_context[i] == '\r' ||
++          cookie_context[i] == '\t' ||
++          cookie_context[i] == '.')
++        return FALSE;
++    }
++
++  return (i > 0);
++}
++
+ static void
+ mechanism_client_data_receive (GDBusAuthMechanism   *mechanism,
+                                const gchar          *data,
+@@ -1163,6 +1191,13 @@ mechanism_client_data_receive (GDBusAuthMechanism   *mechanism,
+     }
+ 
+   cookie_context = tokens[0];
++  if (!validate_cookie_context (tokens[0]))
++    {
++      g_warning ("Malformed cookie_context '%s'", tokens[0]);
++      m->priv->state = G_DBUS_AUTH_MECHANISM_STATE_REJECTED;
++      goto out;
++    }
++
+   cookie_id = g_ascii_strtoll (tokens[1], &endp, 10);
+   if (*endp != '\0')
+     {
diff --git a/glib2.spec b/glib2.spec
index 6387137..6519af1 100644
--- a/glib2.spec
+++ b/glib2.spec
@@ -5,7 +5,7 @@
 
 Name: glib2
 Version: 2.56.4
-Release: 171%{?dist}
+Release: 172%{?dist}
 Summary: A library of handy utility functions
 
 License: LGPLv2+
@@ -175,6 +175,9 @@ Patch36: CVE-2026-58016.patch
 # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5171
 Patch37: CVE-2026-58014.patch
 
+# https://gitlab.gnome.org/GNOME/glib/-/commit/8b72ad09c874ddff122b3e67b3470c5e2eab7690
+Patch38: CVE-2026-58015.patch
+
 %description
 GLib is the low-level core library that forms the basis for projects
 such as GTK+ and GNOME. It provides data structure handling for C,
@@ -375,6 +378,10 @@ make %{?_smp_mflags} check
 %{_datadir}/installed-tests
 
 %changelog
+* Mon Jul 20 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.56.4-172
+- Fix CVE-2026-58015: validate D-Bus DBUS_COOKIE_SHA1 cookie context
+- Resolves: RHEL-212254
+
 * Sun Jul 12 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.56.4-171
 - Fix one-byte heap under-read in g_key_file_get_locale_string_list()
 - Resolves: RHEL-190587