CVE-2026-103963
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A flaw was found in glib-networking where the client-side session cache for TLS 1.3 does not limit the number of session tickets retained for a single host. A malicious server can send excessive session ticket messages, causing unbounded memory growth in the client application, leading to memory exhaustion and a Denial of Service (DoS).
Risk Assessment
A remote attacker can cause a denial of service by exhausting memory in applications using glib-networking, disrupting service availability. This can impact critical applications and require system restarts.
Recommendation
Update glib-networking to a version that includes the fix limiting the number of retained TLS 1.3 session tickets. Monitor memory usage of applications using TLS 1.3.
Other vulnerabilities in glib-networking
See all- CVE-2026-10028Medium
A flaw was found in glib-networking where a specially crafted certificate chain with circular issuer relationships causes an infinite loop during certificate verification. This leads to excessive CPU consumption and denial of service for the affected process.
- CVE-2025-60019Low
The OpenSSL backend in glib-networking fails to properly check the return values of memory allocation routines. An out-of-memory condition could potentially result in writing to an invalid memory location.
- CVE-2025-60018Medium
The OpenSSL backend in glib-networking fails to properly check the return value of a call to BIO_write(), resulting in an out-of-bounds read.
Original NVD description (English source)
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS