OESA-2026-4822: glib-networking security update
glib-networking contains the implementations of certain GLib networking features that cannot be implemented directly in GLib itself because of their dependencies. Security Fix(es):
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).(CVE-2026-103963)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/glib-networkingto a version that resolves this vulnerability.Fixed in 2.78.0-6.oe2403sp1
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Client applications using glib-networking to establish TLS 1.3 connections are exposed when they connect to a malicious server. The server can send excessive session ticket messages and drive unbounded client memory consumption.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction.
What is the impact of successful exploitation?
The client application's memory use can grow until system memory is exhausted, causing a denial of service. The provided vector indicates no confidentiality or integrity impact.