RHSA-2026:99698: Important: glib-networking security update
Important: glib-networking security update
Other sources
The glib-networking packages provide modules that extend the networking support in Glib. In particular, the packages contain a libproxy-based implementation of the GProxyResolver class type and a gnutls-based implementation of the GTlsConnection class type.Security Fix(es): glib-networking: Unbounded TLS 1.3 session ticket queue growth in glib-networking allows remote denial of service (CVE-2026-103963) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/glib-networkingto a version that resolves this vulnerability.Fixed in 2.80.0-3.el10_2.4 - Upgrade
Upgrade
redhat/glib-networking-debuginfoto a version that resolves this vulnerability.Fixed in 2.80.0-3.el10_2.4 - Upgrade
Upgrade
redhat/glib-networking-debugsourceto a version that resolves this vulnerability.Fixed in 2.80.0-3.el10_2.4 - Upgrade
Upgrade
redhat/glib-networking-tests-debuginfoto a version that resolves this vulnerability.Fixed in 2.80.0-3.el10_2.4 - Upgrade
Upgrade
redhat/glib-networkingto a version that resolves this vulnerability.Fixed in 2.80.0-3.el10_2.4.aa - Upgrade
Upgrade
redhat/glib-networking-debuginfoto a version that resolves this vulnerability.Fixed in 2.80.0-3.el10_2.4.aa - Upgrade
Upgrade
redhat/glib-networking-debugsourceto a version that resolves this vulnerability.Fixed in 2.80.0-3.el10_2.4.aa - Upgrade
Upgrade
redhat/glib-networking-tests-debuginfoto a version that resolves this vulnerability.Fixed in 2.80.0-3.el10_2.4.aa
Event History
Frequently Asked Questions
What is the practical impact of this issue?
A remote attacker can cause denial of service by triggering unbounded growth of the TLS 1.3 session ticket queue in glib-networking.
Which systems should be prioritized for remediation?
Prioritize affected Red Hat Enterprise Linux deployments using glib-networking, including listed Extended Life Cycle and Extended Update Support offerings for x86_64, IBM z Systems, and Power little endian.
Does the advisory identify a workaround if updates cannot be applied immediately?
No workaround or temporary mitigation is provided in the advisory data.