Every CVE Search/ Get API key

CVE-2026-10028

Glib-networking: infinite loop in glib-networking gnutls backend allows remote denial of service via circular certificate chain

4.3 MediumFix available

A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application that uses glib-networking with the GnuTLS backend enabled and performs certificate verification. This crafted chain, which contains circular issuer relationships, can cause an infinite loop during certificate verification. The unbounded traversal consumes excessive CPU resources, leading to a denial of service for the affected process or worker.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.18%Up 0.1 points since May 29, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.3

Glib-networking: infinite loop in glib-networking gnutls backend allows remote denial of service via circular certificate chain

A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application that uses glib-networking with the GnuTLS backend enabled and performs certificate verification. This crafted chain, which contains circular issuer relationships, can cause an infinite loop during certificate verification. The unbounded traversal consumes excessive CPU resources, leading to a denial of service for the affected process or worker.

Record
CVE-2026-10028
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-835
Updated
2026-11-06
EUVDEUVD-2026-33166 4.3

A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application that uses glib-networking with the GnuTLS backend enabled and performs certificate verification. This crafted chain, which contains circular issuer relationships, can cause an infinite loop during certificate verification. The unbounded traversal consumes excessive CPU resources, leading to a denial of service for the affected process or worker.

Record
EUVD-2026-33166
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-06
GitHub AdvisoriesGHSA-qvjg-2vfm-53c7 4.3

A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by...

A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application that uses glib-networking with the GnuTLS backend enabled and performs certificate verification. This crafted chain, which contains circular issuer relationships, can cause an infinite loop during certificate verification. The unbounded traversal consumes excessive CPU resources, leading to a denial of service for the affected process or worker.

Record
GHSA-qvjg-2vfm-53c7
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-835
Updated
2026-11-02
NVD 4.3

A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application that uses glib-networking with the GnuTLS backend enabled and performs certificate verification. This crafted chain, which contains circular issuer relationships, can cause an infinite loop during certificate verification. The unbounded traversal consumes excessive CPU resources, leading to a denial of service for the affected process or worker.

Record
CVE-2026-10028
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-835
Updated
2026-11-06
OSVDEBIAN-CVE-2026-10028 4.3

A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application that uses glib-networking with the GnuTLS backend enabled and performs certificate verification. This crafted chain, which contains circular issuer relationships, can cause an infinite loop during certificate verification. The unbounded traversal consumes excessive CPU resources, leading to a denial of service for the affected process or worker.

Record
DEBIAN-CVE-2026-10028
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-07
OSVOESA-2026-2561 4.3

glib-networking security update

glib-networking contains the implementations of certain GLib networking features that cannot be implemented directly in GLib itself because of their dependencies.

Security Fix(es):

A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application that uses glib-networking with the GnuTLS backend enabled and performs certificate verification. This crafted chain, which contains circular issuer relationships, can cause an infinite loop during certificate verification. The unbounded traversal consumes excessive CPU resources, leading to a denial of service for the affected process or worker.(CVE-2026-10028)

Record
OESA-2026-2561
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 11 moreShow less
OSVUBUNTU-CVE-2026-10028 4.3

A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application that uses glib-networking with the GnuTLS backend enabled and performs certificate verification. This crafted chain, which contains circular issuer relationships, can cause an infinite loop during certificate verification. The unbounded traversal consumes excessive CPU resources, leading to a denial of service for the affected process or worker.

Record
UBUNTU-CVE-2026-10028
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-89301 No score

CVE-2026-10028 affecting package glib-networking for versions less than 2.78.0-2

A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application that uses glib-networking with the GnuTLS backend enabled and performs certificate verification. This crafted chain, which contains circular issuer relationships, can cause an infinite loop during certificate verification. The unbounded traversal consumes excessive CPU resources, leading to a denial of service for the affected process or worker.

Record
AZL-89301
Updated
2026-11-05
OSVopenSUSE-SU-2026:11010-1 No score

glib-networking-2.80.1-3.1 on GA media

These are all security issues fixed in the glib-networking-2.80.1-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11010-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21130-1 No score

Security update for glib-networking

This update for glib-networking fixes the following issue

  • CVE-2026-10028: two certificates which are each signed by the other can lead to an infinite loop (bsc#1267979).
Record
openSUSE-SU-2026:21130-1
Updated
2026-11-02
OSVSUSE-SU-2026:22102-1 No score

Security update for glib-networking

This update for glib-networking fixes the following issue

  • CVE-2026-10028: two certificates which are each signed by the other can lead to an infinite loop (bsc#1267979).
Record
SUSE-SU-2026:22102-1
Updated
2026-11-02
OSVSUSE-SU-2026:22135-1 No score

Security update for glib-networking

This update for glib-networking fixes the following issue

  • CVE-2026-10028: two certificates which are each signed by the other can lead to an infinite loop (bsc#1267979).
Record
SUSE-SU-2026:22135-1
Updated
2026-11-02
OSVSUSE-SU-2026:22230-1 No score

Security update for glib-networking

This update for glib-networking fixes the following issue

  • CVE-2026-10028: two certificates which are each signed by the other can lead to an infinite loop (bsc#1267979).
Record
SUSE-SU-2026:22230-1
Updated
2026-11-02
OSVSUSE-SU-2026:22297-1 No score

Security update for glib-networking

This update for glib-networking fixes the following issue

  • CVE-2026-10028: two certificates which are each signed by the other can lead to an infinite loop (bsc#1267979).
Record
SUSE-SU-2026:22297-1
Updated
2026-11-02
OSVSUSE-SU-2026:2810-1 No score

Security update for glib-networking

This update for glib-networking fixes the following issue

  • CVE-2026-10028: two certificates which are each signed by the other can lead to an infinite loop (bsc#1267979).
Record
SUSE-SU-2026:2810-1
Updated
2026-11-02
OSVSUSE-SU-2026:3032-1 No score

Security update for glib-networking

This update for glib-networking fixes the following issue

  • CVE-2026-10028: two certificates which are each signed by the other can lead to an infinite loop (bsc#1267979).
Record
SUSE-SU-2026:3032-1
Updated
2026-11-02
OSVSUSE-SU-2026:3121-1 No score

Security update for glib-networking

This update for glib-networking fixes the following issue

  • CVE-2026-10028: two certificates which are each signed by the other can lead to an infinite loop (bsc#1267979).
Record
SUSE-SU-2026:3121-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
glib-networking
Azure Linux:3
 before 2.78.0-2
2.78.0-2
glib-networking
Debian:12
 All versions, plus listed versions
2.74.0-42.76.0-12.76.1-12.76.1-22.76~beta-1
Show 8 moreShow less
2.78.0-12.80.0-12.80.1-12.80~alpha-12.80~alpha-22.80~rc-12.90.0-12.90.0-2
 None known
glib-networking
Debian:13
 All versions, plus listed versions
2.80.1-12.90.0-12.90.0-2
 None known
glib-networking
Debian:14
 before 2.90.0-1, plus listed versions
2.80.1-1
2.90.0-1
glib-networking
openEuler:24.03-LTS-SP3
 before 2.78.0-4.oe2403sp3
2.78.0-4.oe2403sp3
glib-networking
openEuler:20.03-LTS-SP4
 before 2.62.4-4.oe2003sp4
2.62.4-4.oe2003sp4
glib-networking
openEuler:22.03-LTS-SP4
 before 2.68.1-8.oe2203sp4
2.68.1-8.oe2203sp4
glib-networking
openEuler:24.03-LTS-SP1
 before 2.78.0-4.oe2403sp1
2.78.0-4.oe2403sp1
glib-networking
SUSE:Linux Micro 6.0
 before 2.76.0-4.1
2.76.0-4.1
glib-networking
SUSE:Linux Micro 6.1
 before 2.78.0-slfo.1.1_2.1
2.78.0-slfo.1.1_2.1
Show 18 moreShow less
Affected packages
PackageAffectedFixed
glib-networking
SUSE:Linux Micro 6.2
 before 2.80.1-160000.3.1
2.80.1-160000.3.1
glib-networking
SUSE:Linux Enterprise Server 16.0
 before 2.80.1-160000.3.1
2.80.1-160000.3.1
glib-networking
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 2.80.1-160000.3.1
2.80.1-160000.3.1
glib-networking
SUSE:Linux Enterprise Micro 5.3
 before 2.70.1-150400.3.3.1
2.70.1-150400.3.3.1
glib-networking
SUSE:Linux Enterprise Micro 5.4
 before 2.70.1-150400.3.3.1
2.70.1-150400.3.3.1
glib-networking
SUSE:Linux Enterprise Micro 5.5
 before 2.70.1-150400.3.3.1
2.70.1-150400.3.3.1
glib-networking
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 2.78.0-150600.3.3.1
2.78.0-150600.3.3.1
glib-networking
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 2.48.2-6.6.1
2.48.2-6.6.1
glib-networking
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.46.0-12.46.1-12.46.1-1build12.48.0-12.48.2-1~ubuntu16.04.12.48.2-1~ubuntu16.04.2
 None known
glib-networking
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.54.0-12.54.1-12.54.1-22.55.90-12.56.0-12.56.0-1ubuntu0.1
 None known
glib-networking
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.62.1-12.63.2-12.63.3-0build12.63.90-1ubuntu12.63.91-1ubuntu1
Show 4 moreShow less
2.64.0-12.64.1-12.64.2-1build12.64.2-1ubuntu0.1
 None known
glib-networking
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.68.2-22.70.0-12.70.1-12.72~alpha-12.72~beta-1build12.72.0-1
 None known
glib-networking
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.78.0-12.80~alpha-12.80~rc-12.80.0-1build1
 None known
glib-networking
Ubuntu:25.10
 All versions, plus listed versions
2.80.1-12.80.1-1build1
 None known
glib-networking
Ubuntu:26.10
 All versions, plus listed versions
2.80.1-1build22.90.0-2
 None known
glib-networking
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.80.1-1build12.80.1-1build2
 None known
glib-networking
openSUSE:Tumbleweed
 before 2.80.1-3.1
2.80.1-3.1
glib-networking
openSUSE:Leap 16.0
 before 2.80.1-160000.3.1
2.80.1-160000.3.1

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-10028 is a medium vulnerability (CVSS 4.3) in Red Hat Enterprise Linux 10, published May 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in glib-networking 2.78.0-2.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open