CVE-2026-103963
Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of service
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of service
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).
- Record
CVE-2026-103963- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-12
EUVDEUVD-2026-113706
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).
- Record
EUVD-2026-113706- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
GitHub AdvisoriesGHSA-xwh2-f88c-v27r
A flaw was found in glib-networking. When establishing connections using Transport Layer Security...
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).
- Record
GHSA-xwh2-f88c-v27r- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-13
NVD
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).
- Record
CVE-2026-103963- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-13
OSVDEBIAN-CVE-2026-103963
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).
- Record
DEBIAN-CVE-2026-103963- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVOESA-2026-4821
glib-networking security update
glib-networking contains the implementations of certain GLib networking features that cannot be implemented directly in GLib itself because of their dependencies.
Security Fix(es):
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).(CVE-2026-103963)
- Record
OESA-2026-4821- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-11
Show 11 moreShow less
OSVOESA-2026-4822
glib-networking security update
glib-networking contains the implementations of certain GLib networking features that cannot be implemented directly in GLib itself because of their dependencies.
Security Fix(es):
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).(CVE-2026-103963)
- Record
OESA-2026-4822- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-11
OSVOESA-2026-4823
glib-networking security update
glib-networking contains the implementations of certain GLib networking features that cannot be implemented directly in GLib itself because of their dependencies.
Security Fix(es):
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).(CVE-2026-103963)
- Record
OESA-2026-4823- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-11
OSVRHSA-2026:99695
Red Hat Security Advisory: glib-networking security update
- Record
RHSA-2026:99695- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRHSA-2026:99696
Red Hat Security Advisory: glib-networking security update
- Record
RHSA-2026:99696- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRHSA-2026:99697
Red Hat Security Advisory: glib-networking security update
- Record
RHSA-2026:99697- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRHSA-2026:99698
Red Hat Security Advisory: glib-networking security update
- Record
RHSA-2026:99698- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRLSA-2026:99695
Important: glib-networking security update
The glib-networking packages provide modules that extend the networking support in Glib. In particular, the packages contain a libproxy-based implementation of the GProxyResolver class type and a gnutls-based implementation of the GTlsConnection class type.
Security Fix(es):
- glib-networking: Unbounded TLS 1.3 session ticket queue growth in glib-networking allows remote denial of service (CVE-2026-103963)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:99695- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRLSA-2026:99696
Important: glib-networking security update
The glib-networking packages provide modules that extend the networking support in Glib. In particular, the packages contain a libproxy-based implementation of the GProxyResolver class type and a gnutls-based implementation of the GTlsConnection class type.
Security Fix(es):
- glib-networking: Unbounded TLS 1.3 session ticket queue growth in glib-networking allows remote denial of service (CVE-2026-103963)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:99696- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVUBUNTU-CVE-2026-103963
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).
- Record
UBUNTU-CVE-2026-103963- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
OSVAZL-112445No score
CVE-2026-103963 affecting package glib-networking for versions less than 2.78.0-3
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).
- Record
AZL-112445- Updated
- 2026-11-06
OSVopenSUSE-SU-2026:12363-1No score
glib-networking-2.90.1-1.1 on GA media
These are all security issues fixed in the glib-networking-2.90.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12363-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
glib-networkingAzure Linux:3 | before 2.78.0-3 | 2.78.0-3 |
glib-networkingDebian:12 | All versions, plus listed versions 2.74.0-42.76.0-12.76.1-12.76.1-22.76~beta-1 Show 8 moreShow less2.78.0-12.80.0-12.80.1-12.80~alpha-12.80~alpha-22.80~rc-12.90.0-12.90.0-2 | None known |
glib-networkingDebian:13 | All versions, plus listed versions 2.80.1-12.90.0-12.90.0-2 | None known |
glib-networkingDebian:14 | All versions, plus listed versions 2.80.1-12.90.0-12.90.0-2 | None known |
glib-networkingopenEuler:24.03-LTS-SP4 | before 2.78.0-6.oe2403sp4 | 2.78.0-6.oe2403sp4 |
glib-networkingopenEuler:24.03-LTS-SP1 | before 2.78.0-6.oe2403sp1 | 2.78.0-6.oe2403sp1 |
glib-networkingopenEuler:24.03-LTS-SP3 | before 2.78.0-6.oe2403sp3 | 2.78.0-6.oe2403sp3 |
glib-networkingRed Hat:enterprise_linux:9::appstream | before 0:2.68.3-3.el9_9.1 | 0:2.68.3-3.el9_9.1 |
glib-networking-debuginfoRed Hat:enterprise_linux:9::appstream | before 0:2.68.3-3.el9_9.1 | 0:2.68.3-3.el9_9.1 |
glib-networking-debugsourceRed Hat:enterprise_linux:9::appstream | before 0:2.68.3-3.el9_9.1 | 0:2.68.3-3.el9_9.1 |
Show 35 moreShow less
| Package | Affected | Fixed |
|---|---|---|
glib-networking-tests-debuginfoRed Hat:enterprise_linux:9::appstream | before 0:2.68.3-3.el9_9.1 | 0:2.68.3-3.el9_9.1 |
glib-networkingRed Hat:enterprise_linux:9::baseos | before 0:2.68.3-3.el9_9.1 | 0:2.68.3-3.el9_9.1 |
glib-networking-debuginfoRed Hat:enterprise_linux:9::baseos | before 0:2.68.3-3.el9_9.1 | 0:2.68.3-3.el9_9.1 |
glib-networking-debugsourceRed Hat:enterprise_linux:9::baseos | before 0:2.68.3-3.el9_9.1 | 0:2.68.3-3.el9_9.1 |
glib-networking-tests-debuginfoRed Hat:enterprise_linux:9::baseos | before 0:2.68.3-3.el9_9.1 | 0:2.68.3-3.el9_9.1 |
glib-networkingRed Hat:enterprise_linux:10.3 | before 0:2.80.0-3.el10_3.4 | 0:2.80.0-3.el10_3.4 |
glib-networking-debuginfoRed Hat:enterprise_linux:10.3 | before 0:2.80.0-3.el10_3.4 | 0:2.80.0-3.el10_3.4 |
glib-networking-debugsourceRed Hat:enterprise_linux:10.3 | before 0:2.80.0-3.el10_3.4 | 0:2.80.0-3.el10_3.4 |
glib-networking-tests-debuginfoRed Hat:enterprise_linux:10.3 | before 0:2.80.0-3.el10_3.4 | 0:2.80.0-3.el10_3.4 |
glib-networkingRed Hat:rhel_eus:9.8::appstream | before 0:2.68.3-3.el9_8.1 | 0:2.68.3-3.el9_8.1 |
glib-networking-debuginfoRed Hat:rhel_eus:9.8::appstream | before 0:2.68.3-3.el9_8.1 | 0:2.68.3-3.el9_8.1 |
glib-networking-debugsourceRed Hat:rhel_eus:9.8::appstream | before 0:2.68.3-3.el9_8.1 | 0:2.68.3-3.el9_8.1 |
glib-networking-tests-debuginfoRed Hat:rhel_eus:9.8::appstream | before 0:2.68.3-3.el9_8.1 | 0:2.68.3-3.el9_8.1 |
glib-networkingRed Hat:rhel_eus:9.8::baseos | before 0:2.68.3-3.el9_8.1 | 0:2.68.3-3.el9_8.1 |
glib-networking-debuginfoRed Hat:rhel_eus:9.8::baseos | before 0:2.68.3-3.el9_8.1 | 0:2.68.3-3.el9_8.1 |
glib-networking-debugsourceRed Hat:rhel_eus:9.8::baseos | before 0:2.68.3-3.el9_8.1 | 0:2.68.3-3.el9_8.1 |
glib-networking-tests-debuginfoRed Hat:rhel_eus:9.8::baseos | before 0:2.68.3-3.el9_8.1 | 0:2.68.3-3.el9_8.1 |
glib-networkingRed Hat:enterprise_linux_eus:10.2 | before 0:2.80.0-3.el10_2.4 | 0:2.80.0-3.el10_2.4 |
glib-networking-debuginfoRed Hat:enterprise_linux_eus:10.2 | before 0:2.80.0-3.el10_2.4 | 0:2.80.0-3.el10_2.4 |
glib-networking-debugsourceRed Hat:enterprise_linux_eus:10.2 | before 0:2.80.0-3.el10_2.4 | 0:2.80.0-3.el10_2.4 |
glib-networking-tests-debuginfoRed Hat:enterprise_linux_eus:10.2 | before 0:2.80.0-3.el10_2.4 | 0:2.80.0-3.el10_2.4 |
glib-networkingRocky Linux:9 | before 0:2.68.3-3.el9_9.1 | 0:2.68.3-3.el9_9.1 |
glib-networking-debuginfoRocky Linux:9 | before 0:2.68.3-3.el9_9.1 | 0:2.68.3-3.el9_9.1 |
glib-networking-debugsourceRocky Linux:9 | before 0:2.68.3-3.el9_9.1 | 0:2.68.3-3.el9_9.1 |
glib-networking-debugsourceRocky Linux:10 | before 0:2.80.0-3.el10_3.4 | 0:2.80.0-3.el10_3.4 |
glib-networkingRocky Linux:10 | before 0:2.80.0-3.el10_3.4 | 0:2.80.0-3.el10_3.4 |
glib-networking-debuginfoRocky Linux:10 | before 0:2.80.0-3.el10_3.4 | 0:2.80.0-3.el10_3.4 |
glib-networkingUbuntu:16.04:LTS | All versions, plus listed versions 2.46.0-12.46.1-12.46.1-1build12.48.0-12.48.2-1~ubuntu16.04.12.48.2-1~ubuntu16.04.2 | None known |
glib-networkingUbuntu:18.04:LTS | All versions, plus listed versions 2.54.0-12.54.1-12.54.1-22.55.90-12.56.0-12.56.0-1ubuntu0.1 | None known |
glib-networkingUbuntu:20.04:LTS | All versions, plus listed versions 2.62.1-12.63.2-12.63.3-0build12.63.90-1ubuntu12.63.91-1ubuntu1 Show 4 moreShow less2.64.0-12.64.1-12.64.2-1build12.64.2-1ubuntu0.1 | None known |
glib-networkingUbuntu:22.04:LTS | All versions, plus listed versions 2.68.2-22.70.0-12.70.1-12.72~alpha-12.72~beta-1build12.72.0-1 | None known |
glib-networkingUbuntu:24.04:LTS | All versions, plus listed versions 2.78.0-12.80~alpha-12.80~rc-12.80.0-1build1 | None known |
glib-networkingUbuntu:26.10 | All versions, plus listed versions 2.80.1-1build22.90.0-2 | None known |
glib-networkingUbuntu:26.04:LTS | All versions, plus listed versions 2.80.1-1build12.80.1-1build2 | None known |
glib-networkingopenSUSE:Tumbleweed From an advisory covering 7 CVEs | before 2.90.1-1.1 | 2.90.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | EUVD, GitHub Advisories, NVD, OSV | |
| products, references | CVE List, NVD | |
| references | CVE List | |
| references | EUVD | |
| affected, aliases, references | OSV | |
| affected, facts | OSV | |
| affected, facts | CVE List, EUVD, NVD, OSV | |
| facts | CVE List | |
| affected, aliases, references | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-103963 is a high vulnerability (CVSS 7.5) in Red Hat Enterprise Linux 10, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in glib-networking 2.78.0-3.
References
access.redhat.com/errata/RHSA-2026:99695
bugzilla.redhat.com/show_bug.cgi?id=2465656
Show 23 moreShow less
gitlab.gnome.org/GNOME/glib-networking/-/merge_requests/288
nvd.nist.gov/vuln/detail/CVE-2026-103963
github.com/advisories/GHSA-xwh2-f88c-v27r
security-tracker.debian.org/tracker/CVE-2026-103963
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4821
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99695.json
cve.org/CVERecord?id=CVE-2026-103963
errata.rockylinux.org/RLSA-2026:99695
ubuntu.com/security/CVE-2026-103963
suse.com/security/cve/CVE-2025-60018