OESA-2026-4823: glib-networking security update
glib-networking contains the implementations of certain GLib networking features that cannot be implemented directly in GLib itself because of their dependencies. Security Fix(es):
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).(CVE-2026-103963)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/glib-networkingto a version that resolves this vulnerability.Fixed in 2.78.0-6.oe2403sp3
Event History
Frequently Asked Questions
Which systems are exposed to this denial-of-service issue?
Client applications using glib-networking that establish TLS 1.3 connections are exposed. The issue is triggered by a malicious TLS server and can lead to exhaustion of the client system's memory.
What does an attacker need to exploit the flaw?
An attacker needs to operate or control a TLS 1.3 server that a vulnerable client connects to. No client-side privileges or user interaction are indicated.
How does the denial of service occur?
The malicious server sends excessive TLS session ticket messages. Because the client-side session cache does not limit retained tickets for a single host, memory consumption can grow without bound until system memory is exhausted.