CVE-2026-103963

Name of the Vulnerable Software and Affected Versions glib-networking versions prior to 2.90.1-1.1

Description A flaw exists when establishing connections using Transport Layer Security (TLS) version 1.3, where the client-side session cache fails to limit the number of session tickets retained for a single host. A malicious server can send excessive session ticket messages, leading to continuous memory consumption by the client application. This unbounded memory growth can exhaust system resources, resulting in a Denial of Service (DoS).

Recommendations Update to version 2.90.1-1.1.