Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of service
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Default setups
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
glib-networking, the library that provides TLS and network connection support for GLib-based applications, is affected when it acts as a client using TLS 1.3. A malicious server can send a large number of session tickets, causing the client's memory use to grow without limit until the system runs out of memory and denial of service results.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).
Timeline
- CVE published
- First seen by cve.now
Affected versions
- glib-networking
Version range not reported
- glib-networking
Version range not reported
- glib-networking
Version range not reported
- glib-networking
Version range not reported
- glib-networking
Version range not reported
References 3
access.redhat.com
bugzilla.redhat.com
gitlab.gnome.org
Questions about CVE-2026-103963
What does this mean?
A TLS 1.3 client keeps session tickets from a server in an unbounded queue for a single host, so a malicious server that sends many session ticket messages can make the client's memory grow without limit. This can exhaust system memory and cause a denial of service.Source: access.redhat.com, bugzilla.redhat.com
Am I affected, and how do I check?
The affected setup is a client that uses TLS 1.3 with session resumption enabled, so its session cache keeps session tickets, and that connects to a TLS 1.3 server sending excessive session ticket messages. The affected products listed are Red Hat Enterprise Linux 6, 7, 8, 9 and 10, but no affected version ranges are given. Check the installed glib-networking package version against Red Hat's advisory for this CVE.Source: access.redhat.com, bugzilla.redhat.com
What should I do about it?
No fixed package version is given in the checked facts, so no upgrade target can be stated. Apply the vendor's fix when a package update is released.Source: access.redhat.com, bugzilla.redhat.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
Until a package fix is available, disable TLS session resumption for affected client workloads where possible. Alternatively, avoid connecting those clients to untrusted TLS 1.3 endpoints.Source: access.redhat.com, bugzilla.redhat.com