glib-networking EUVD-2026-33166

Two non-default conditions must both be true: the target application must use glib-networking's GnuTLS backend specifically (not the OpenSSL backend), and the application must perform TLS certificate verification rather than disabling it. Beyond those application-level requirements, the CVSS vector encodes one runtime condition: user interaction (UI:R) is required, meaning a user or process must actively initiate a connection to the attacker-controlled server - the attacker cannot push the malicious certificate chain to a passive victim. Exploitation is further limited by scope S:U (impact contained to the vulnerable process, not the broader system) and impact ceiling A:L (partial availability loss, not full compromise). Authentication is not required from the attacker's side (PR:N). The primary limiting factor for defenders to assess realistic risk is whether their applications use the GnuTLS backend and whether their users or services can be directed to connect to external adversary infrastructure.

The CVSS 4.3 (Medium) score reflects several important mitigating factors encoded in the vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). Although no attacker privileges are required (PR:N) and complexity is low (AC:L), user interaction is required (UI:R) - a user or automated process must initiate a connection to a server under attacker control. The impact is limited to availability, and only at the 'Low' level (A:L), meaning partial degradation rather than full system outage; typically only the affected process or worker thread is impacted, not the entire system. No EPSS score was provided, no POC exploit has been identified, and the vulnerability is not listed in the CISA KEV catalog. Cross-referencing these signals: this is a real but moderate-priority issue. It is most dangerous in server-side scenarios where a trusted process repeatedly connects to external TLS endpoints (e.g., a worker daemon fetching external feeds), where attacker-controlled infrastructure could stall that specific worker. It is not suitable for mass automated exploitation due to the UI:R requirement.

An attacker operates a malicious HTTPS server whose TLS certificate chain contains a deliberately circular issuer relationship between two certificates. When a user on a RHEL system visits the attacker's site (or an automated process connects to it) via an application built on glib-networking with the GnuTLS backend, the certificate verifier enters an infinite loop consuming CPU. If the application runs as a multi-process worker pool, only the affected worker is stalled, degrading throughput; in a single-process application, the entire service becomes unresponsive. No public exploit code exists at time of analysis, but the attack concept is straightforward and reproducible from the description alone.