DEBIAN-CVE-2026-103963: High severity debian/glib-networking vulnerability
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this denial of service?
Client applications using Debian's glib-networking that establish TLS 1.3 connections are exposed. A malicious TLS server can trigger memory growth on the client.
What does an attacker need to exploit the issue?
The attacker needs to operate or control a TLS 1.3 server that the affected client connects to. No client-side privileges or user interaction are required beyond causing the client to establish that connection.
What is the impact of a successful attack?
The malicious server can send excessive TLS session ticket messages, causing the client session cache to retain an unbounded number of tickets for that host. Memory consumption can grow until system memory is exhausted, resulting in denial of service.