RLSA-2026:99696: Important: glib-networking security update
The glib-networking packages provide modules that extend the networking support in Glib. In particular, the packages contain a libproxy-based implementation of the GProxyResolver class type and a gnutls-based implementation of the GTlsConnection class type.
Security Fix(es):
glib-networking: Unbounded TLS 1.3 session ticket queue growth in glib-networking allows remote denial of service (CVE-2026-103963)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/glib-networking-debugsourceto a version that resolves this vulnerability.Fixed in 0:2.80.0-3.el10_3.4 - Upgrade
Upgrade
rocky-linux/glib-networkingto a version that resolves this vulnerability.Fixed in 0:2.80.0-3.el10_3.4 - Upgrade
Upgrade
rocky-linux/glib-networking-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.80.0-3.el10_3.4
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue is remotely exploitable over the network and requires no privileges or user interaction, as reflected by the AV:N/AC:L/PR:N/UI:N vector.
What is the likely impact of successful exploitation?
Successful exploitation can cause a denial of service through unbounded growth of the TLS 1.3 session ticket queue. The provided vector indicates availability impact only, with no stated confidentiality or integrity impact.
Which component is affected?
The affected functionality is the gnutls-based implementation of the GTlsConnection class provided by glib-networking. The issue is identified as CVE-2026-103963.