---
id: "CVE-2026-103963"
kind: "vulnerability"
aliases: ["CVE-2026-103963"]
title: "glib-networking: unbounded TLS 1.3 session tickets exhaust client memory"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "glib-networking", "fixed": ["2.90.1"], "affected": "< 2.90.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["denial-of-service", "gio", "glib-networking", "infrastructure", "linux", "tls-client"]
not_affected_if: ["no-tls13-client-use", "trusted-servers-only"]
published_at: "2026-10-30T05:16:57+00:00"
first_seen_at: "2026-10-30T05:28:35+00:00"
updated_at: "2026-10-30T05:30:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103963", "first_seen_at": "2026-10-30T05:28:35+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T05:30:51+00:00"}]
---

# glib-networking: unbounded TLS 1.3 session tickets exhaust client memory

glib-networking does not cap how many TLS 1.3 session tickets its client-side cache keeps for one host. A malicious server can send many session tickets, making the client application consume memory until the system runs out.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:glib-networking affected < 2.90.1 fixed 2.90.1

## How to check

Check installed version: pkg-config --modversion glib-networking is not provided; use your package manager (e.g. pacman -Q glib-networking, dpkg -l glib-networking, rpm -q glib-networking) and compare to 2.90.1. Applications using GIO TLS (GnuTLS or OpenSSL backend) for outbound TLS 1.3 are the exposed ones.

## Fix

Upgrade glib-networking to 2.90.1 or later (or your distro's backport).

## Timeline

- 2026-10-30T05:28:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103963
- 2026-10-30T05:30:51+00:00 analyst — Fixed in glib-networking 2.90.1 (Oct 23 2026, issue #234, commit fcae2b237b) per NEWS as quoted by BLFS ticket; upstream gitlab NEWS/issue not retrievable (web-cli mirror stale), so nothing marked verified. Lower affected bound unknown. No PoC or exploitation seen.

## Documents

- [fix] BLFS ticket: glib-networking-2.90.1 (quotes upstream NEWS) https://wiki.linuxfromscratch.org/blfs/ticket/24178
- [mentions] Feedly CVE-2026-103963 https://feedly.com/cve/CVE-2026-103963

## From the sources

A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_