AZL-112445: CVE-2026-103963 affecting package glib-networking 2.78.0-2

Q: Which systems are exposed to this denial-of-service condition?

Client applications using the affected glib-networking package when they establish TLS 1.3 connections are exposed. The condition is triggered by a malicious server, so systems acting only as servers are not described as affected by this issue.

Q: What must an attacker be able to do to exploit it?

An attacker must control or operate a TLS 1.3 server that a vulnerable client connects to. The server can then send excessive TLS session ticket messages to drive unbounded client-side memory consumption.

Q: What is the operational impact if exploitation succeeds?

The affected client application can continuously consume memory because session tickets for one host are not bounded. This can exhaust system memory and cause a denial of service.

Published Oct 30, 2026

Updated

A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).

Affected Software

1 affected component

azure-linux/glib-networking<=2.78.0-2

Event History

Oct 30, 2026

Advisory Published

via OSV·05:16 AM

Data Sourced

via OSV·05:16 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-103963

Frequently Asked Questions

Which systems are exposed to this denial-of-service condition?

Client applications using the affected glib-networking package when they establish TLS 1.3 connections are exposed. The condition is triggered by a malicious server, so systems acting only as servers are not described as affected by this issue.

What must an attacker be able to do to exploit it?

An attacker must control or operate a TLS 1.3 server that a vulnerable client connects to. The server can then send excessive TLS session ticket messages to drive unbounded client-side memory consumption.

What is the operational impact if exploitation succeeds?

The affected client application can continuously consume memory because session tickets for one host are not bounded. This can exhaust system memory and cause a denial of service.

AZL-112445: CVE-2026-103963 affecting package glib-networking 2.78.0-2

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are exposed to this denial-of-service condition?

What must an attacker be able to do to exploit it?

What is the operational impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this denial-of-service condition?

What must an attacker be able to do to exploit it?

What is the operational impact if exploitation succeeds?