GNOME glib-networking: TLS 1.3 session cache memory exhaustion (CVE-2026-103963)
A vulnerability in glib-networking allows a malicious TLS 1.3 server to trigger unbounded memory consumption in client applications via excessive session ticket messages, leading to a denial-of-service condition.
CVE search metadata
CVE search record: CVE-2026-103963. Severity: high. CVSS: 7.5. KEV: no. Product: glib-networking. Brief: GNOME glib-networking: TLS 1.3 session cache memory exhaustion (CVE-2026-103963). Brief link: https://feed.craftedsignal.io/briefs/2026-10-glib-networking-dos/
Triage facts
Revision 1- Applicability
- glib-networking
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 30, 07:20 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
CVE-2026-103963 is a memory exhaustion vulnerability in glib-networking. When a client performs a TLS 1.3 handshake, the library fails to limit the number of session tickets retained in the client-side session cache for a specific host. A malicious server can send an excessive number of session ticket messages during the handshake process, forcing the client application to continuously allocate memory. This behavior leads to memory exhaustion and potential crash of the client application, resulting in a Denial of Service.
Impact
Successful exploitation results in a Denial of Service (DoS) for any application utilizing the affected glib-networking library, caused by the exhaustion of system memory resources.
Recommendation
Identify and patch instances of glib-networking to the latest available version provided by the distribution or GNOME project. Prioritize patching client applications that frequently initiate TLS connections to untrusted or external endpoints, as these are the primary vectors for this memory exhaustion attack.
Threat Hunt
Identify client applications exhibiting anomalous memory growth patterns following network activity
Data: Endpoint memory usage monitoring (e.g., resident set size), Network connection logs for TLS 1.3 handshakes
Mitigations
Patch glib-networking to the latest vendor-supplied version to remediate CVE-2026-103963
CVE-2026-103963