{"id":"CVE-2026-103963","kind":"vulnerability","aliases":["CVE-2026-103963"],"related":[],"title":"glib-networking: unbounded TLS 1.3 session tickets exhaust client memory","description":"A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).","summary":"glib-networking does not cap how many TLS 1.3 session tickets its client-side cache keeps for one host. A malicious server can send many session tickets, making the client application consume memory until the system runs out.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"glib-networking","fixed":["2.90.1"],"affected":"< 2.90.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["denial-of-service","gio","glib-networking","infrastructure","linux","tls-client"],"not_affected_if":["no-tls13-client-use","trusted-servers-only"],"how_to_check":"Check installed version: pkg-config --modversion glib-networking is not provided; use your package manager (e.g. pacman -Q glib-networking, dpkg -l glib-networking, rpm -q glib-networking) and compare to 2.90.1. Applications using GIO TLS (GnuTLS or OpenSSL backend) for outbound TLS 1.3 are the exposed ones.","fix":"Upgrade glib-networking to 2.90.1 or later (or your distro's backport).","status":"open","published_at":"2026-10-30T05:16:57+00:00","first_seen_at":"2026-10-30T05:28:35+00:00","triaged_at":"2026-10-30T05:29:23+00:00","updated_at":"2026-10-30T05:30:51+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-30T05:29:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"glib-networking: unbounded TLS 1.3 session tickets exhaust client memory","impact":"low","summary":"glib-networking does not cap how many TLS 1.3 session tickets its client-side cache keeps for one host. A malicious server can send many session tickets, making the client application consume memory until the system runs out.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["glib-networking","linux","gio","tls-client"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"client application memory exhausted by a malicious server, causing denial of service","analyst_note":"Check the NVD entry and the upstream glib-networking advisory for affected and fixed versions; the sources here give no version ranges.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-tls13-client-use","trusted-servers-only"],"who_is_affected":"Applications on Linux desktops or servers that use glib-networking (GIO TLS backend) to make outbound TLS 1.3 connections are exposed when they connect to a hostile server. Systems that do not use glib-networking's TLS client, or that only talk to trusted servers, are lower risk. The sources do not name specific affected versions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000661,"input_tokens":4134,"output_tokens":496,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the upstream glib-networking advisory for affected and fixed versions; the sources here give no version ranges.","search":"'-103963':14A,17A '-2026':13A,16A '1.3':6A,43B,90C 'applic':66B,125C 'cach':50B,96C 'cap':39B 'caus':122C 'client':10A,33B,48B,65B,93C,124C 'client-sid':47B,92C 'connect':83C 'consum':67B,128C 'continu':127C 'cve':12A,15A 'denial':22B,141C 'denial-of-servic':21B 'dos':144C 'establish':82C 'excess':118C 'exhaust':9A,135C 'exploit':114C 'flaw':74C 'found':76C 'gio':25B 'glib':2A,19A,27B,35B,79C 'glib-network':1A,26B,34B,78C 'glib-networking':18A 'growth':133C 'host':54B,109C 'infrastructur':29B 'keep':51B 'layer':86C 'limit':99C 'linux':30B 'make':63B 'malici':56B,111C 'mani':41B,60B 'memori':11A,68B,129C,132C,137C 'messag':121C 'network':3A,28B,36B,80C 'networking':20A 'number':101C 'one':53B 'result':138C 'retain':105C 'run':72B 'secur':87C 'send':59B,117C 'server':57B,112C 'servic':24B,143C 'session':7A,44B,61B,95C,103C,119C 'side':49B,94C 'singl':108C 'system':71B,136C 'ticket':8A,45B,62B,104C,120C 'tls':5A,32B,42B,88C 'tls-client':31B 'transport':85C 'unbound':4A,131C 'use':84C 'version':89C","nicknames":[],"mitigations":[],"who_affected":"Applications on Linux desktops or servers that use glib-networking (GIO TLS backend) to make outbound TLS 1.3 connections are exposed when they connect to a hostile server. Systems that do not use glib-networking's TLS client, or that only talk to trusted servers, are lower risk. The sources do not name specific affected versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T05:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103963","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103963","severity":null,"published_at":"2026-10-30T05:16:57+00:00","modified_at":"2026-10-30T05:16:57+00:00","first_seen_at":"2026-10-30T05:28:35+00:00","fetched_at":"2026-10-30T05:28:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103963:1129","url":null,"severity":null,"published_at":"2026-10-30T05:30:51+00:00","modified_at":"2026-10-30T05:30:51+00:00","first_seen_at":"2026-10-30T05:30:51+00:00","fetched_at":"2026-10-30T05:30:51+00:00","note":"Fixed in glib-networking 2.90.1 (Oct 23 2026, issue #234, commit fcae2b237b) per NEWS as quoted by BLFS ticket; upstream gitlab NEWS/issue not retrievable (web-cli mirror stale), so nothing marked verified. Lower affected bound unknown. No PoC or exploitation seen."}],"documents":[{"id":21562,"url":"https://wiki.linuxfromscratch.org/blfs/ticket/24178","title":"BLFS ticket: glib-networking-2.90.1 (quotes upstream NEWS)","kind":"other","source":"analyst","publisher":null,"text":"2.90.1 - October 23, 2026 Bugs fixed: #234 (CVE-2026-103963) Unbounded TLS 1.3 session ticket queue growth in glib-networking allows remote denial of service (Nieves Montero Fernandez). Fixed at fcae2b237b.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":21563,"url":"https://feedly.com/cve/CVE-2026-103963","title":"Feedly CVE-2026-103963","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}