Live › vulnerability › CVE-2026-103963
glib-networking does not cap how many TLS 1.3 session tickets its client-side cache keeps for one host. A malicious server can send many session tickets, making the client application consume memory until the system runs out.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 05:28 UTC. All times on this page are UTC.
Applications on Linux desktops or servers that use glib-networking (GIO TLS backend) to make outbound TLS 1.3 connections are exposed when they connect to a hostile server. Systems that do not use glib-networking's TLS client, or that only talk to trusted servers, are lower risk. The sources do not name specific affected versions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| glib-networking | vendor | < 2.90.1 | 2.90.1 |
dpkg -l glib-networking rpm -q glib-networking) and compare to 2.90.1Upgrade glib-networking to 2.90.1 or later (or your distro's backport).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).
This page as .md · .json · in your agent: get_signal("CVE-2026-103963")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.