CVE-2025-60019
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The OpenSSL backend in glib-networking fails to properly check the return values of memory allocation routines. An out-of-memory condition could potentially result in writing to an invalid memory location.
Risk Assessment
The risk involves possible memory corruption, which could lead to application crashes or potential arbitrary code execution by an attacker.
Recommendation
It is recommended to update glib-networking to the latest version that includes a fix for checking return values of memory allocations.
Other vulnerabilities in glib-networking
See all- CVE-2026-103963High
A flaw was found in glib-networking where the client-side session cache for TLS 1.3 does not limit the number of session tickets retained for a single host. A malicious server can send excessive session ticket messages, causing unbounded memory growth in the client application, leading to memory exhaustion and a Denial of Service (DoS).
- CVE-2026-10028Medium
A flaw was found in glib-networking where a specially crafted certificate chain with circular issuer relationships causes an infinite loop during certificate verification. This leads to excessive CPU consumption and denial of service for the affected process.
- CVE-2025-60018Medium
The OpenSSL backend in glib-networking fails to properly check the return value of a call to BIO_write(), resulting in an out-of-bounds read.
Original NVD description (English source)
glib-networking's OpenSSL backend fails to properly check the return value of memory allocation routines. An out of memory condition could potentially result in writing to an invalid memory location.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS