{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3agnomeglib-networking/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gnome:glib-networking:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-103963"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["glib-networking"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","glib-networking"],"_cs_type":"advisory","_cs_vendors":["GNOME"],"content_html":"\u003cp\u003eCVE-2026-103963 is a memory exhaustion vulnerability in glib-networking. When a client performs a TLS 1.3 handshake, the library fails to limit the number of session tickets retained in the client-side session cache for a specific host. A malicious server can send an excessive number of session ticket messages during the handshake process, forcing the client application to continuously allocate memory. This behavior leads to memory exhaustion and potential crash of the client application, resulting in a Denial of Service.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a Denial of Service (DoS) for any application utilizing the affected glib-networking library, caused by the exhaustion of system memory resources.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eIdentify and patch instances of glib-networking to the latest available version provided by the distribution or GNOME project. Prioritize patching client applications that frequently initiate TLS connections to untrusted or external endpoints, as these are the primary vectors for this memory exhaustion attack.\u003c/p\u003e\n","date_modified":"2026-10-30T07:20:10Z","date_published":"2026-10-30T07:20:10Z","id":"https://feed.craftedsignal.io/briefs/2026-10-glib-networking-dos/","summary":"A vulnerability in glib-networking allows a malicious TLS 1.3 server to trigger unbounded memory consumption in client applications via excessive session ticket messages, leading to a denial-of-service condition.","title":"GNOME glib-networking: TLS 1.3 session cache memory exhaustion (CVE-2026-103963)","url":"https://feed.craftedsignal.io/briefs/2026-10-glib-networking-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:gnome:glib-Networking:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}