OESA-2026-4821: glib-networking security update

Q: Which systems are exposed to this denial-of-service issue?

Client applications using the affected glib-networking software when establishing TLS 1.3 connections are exposed. A malicious TLS server can target such clients by sending excessive session ticket messages.

Q: What does an attacker need to exploit the issue?

The attacker needs to operate or control a server that a vulnerable client connects to using TLS 1.3. No client-side privileges or user interaction are indicated by the provided severity vector.

Q: What is the likely impact of successful exploitation?

Session tickets for one host can accumulate without a limit in the client-side session cache, causing continuous memory consumption. This can exhaust system memory and deny service to the affected client system.

Published Nov 11, 2026

Updated

glib-networking contains the implementations of certain GLib networking features that cannot be implemented directly in GLib itself because of their dependencies. Security Fix(es):

A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).(CVE-2026-103963)

Affected Software

1 affected componentFixes available

openeuler/glib-networking<2.78.0-6.oe2403sp4

2.78.0-6.oe2403sp4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/glib-networking to a version that resolves this vulnerability.
Fixed in 2.78.0-6.oe2403sp4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:26 PM

Data Sourced

via OSV·12:26 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-103963

Frequently Asked Questions

Which systems are exposed to this denial-of-service issue?

Client applications using the affected glib-networking software when establishing TLS 1.3 connections are exposed. A malicious TLS server can target such clients by sending excessive session ticket messages.

What does an attacker need to exploit the issue?

The attacker needs to operate or control a server that a vulnerable client connects to using TLS 1.3. No client-side privileges or user interaction are indicated by the provided severity vector.

What is the likely impact of successful exploitation?

Session tickets for one host can accumulate without a limit in the client-side session cache, causing continuous memory consumption. This can exhaust system memory and deny service to the affected client system.

OESA-2026-4821: glib-networking security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are exposed to this denial-of-service issue?

What does an attacker need to exploit the issue?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this denial-of-service issue?

What does an attacker need to exploit the issue?

What is the likely impact of successful exploitation?