glib-networking CVE-2026-103963

Exploitation requires the victim to use a glib-networking-backed TLS client that negotiates TLS 1.3 and to establish a connection to an attacker-controlled (or attacker-influenced) server; the server then sends an excessive volume of TLS 1.3 session ticket messages that the client's per-host session cache retains without limit. LIMITING FACTORS: this is a client-side condition - the attacker cannot reach a victim unsolicited but must get the client to initiate/complete an outbound TLS 1.3 session (e.g., via a malicious or compromised endpoint, redirect, or MITM position); it is specific to TLS 1.3 session resumption/ticket handling, not earlier TLS versions; and the impact is confined to availability (memory exhaustion) with no confidentiality or integrity effect. Applicability spans Red Hat Enterprise Linux 6 through 10 as tracked by Red Hat.

This is a genuine but bounded availability issue, not a top-tier emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5, HIGH) reflects a pure availability impact (C:N/I:N/A:H) - there is no code execution or data exposure, only memory exhaustion leading to Denial of Service, consistent with CWE-400 (Uncontrolled Resource Consumption). The PR:N/AC:L/AV:N metrics describe a network-reachable, low-complexity, unauthenticated condition, but the direction matters: this is a CLIENT-side flaw triggered when the victim's glib-networking TLS client connects to a MALICIOUS SERVER, so the attacker must induce or receive an outbound TLS 1.3 connection rather than directly reaching a listening service. EPSS is not provided in the input and KEV status is not listed (not confirmed exploited). No proof-of-concept or exploit reference is present - the only code link is the upstream fix merge request. The vuln.today decision label is 'this_week', aligning with a patch-promptly-but-not-drop-everything posture appropriate for a DoS with no confidentiality/integrity impact and no observed exploitation. Net: treat as a routine prioritized patch for Linux fleets running GLib/GIO-based TLS clients, not an active-exploitation fire drill.

An attacker who controls (or can redirect a victim to) a TLS 1.3 server waits for a glib-networking-based client application to connect, then floods the completed session with an excessive number of TLS 1.3 session ticket (NewSessionTicket) messages. Because the client-side session cache does not bound the number of tickets retained per host, the client keeps allocating memory until system memory is exhausted and the application - or host - is driven into a Denial of Service. No public exploit identified at time of analysis; this scenario is inferred from the description plus the AV:N/AC:L vector.