CVE-2026-10028

A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application that uses glib-networking with the GnuTLS backend enabled and performs certificate verification. This crafted chain, which contains circular issuer relationships, can cause an infinite loop during certificate verification. The unbounded traversal consumes excessive CPU resources, leading to a denial of service for the affected process or worker.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-10028
https://bugzilla.redhat.com/show_bug.cgi?id=2465152
https://gitlab.gnome.org/GNOME/glib-networking/-/work_items/231

Configurations

No configuration.

History

21 Jul 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una falla en glib-networking. Un atacante remoto puede explotar esta vulnerabilidad al presentar una cadena de certificados especialmente diseñada a una aplicación que utiliza glib-networking con el backend de GnuTLS habilitado y que realiza la verificación de certificados. Esta cadena diseñada, que contiene relaciones de emisor circulares, puede causar un bucle infinito durante la verificación de certificados. El recorrido ilimitado consume recursos excesivos de CPU, lo que lleva a una denegación de servicio para el proceso o trabajador afectado.

28 May 2026, 23:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-28 23:16

Updated : 2026-07-21 10:10

NVD link : CVE-2026-10028

Mitre link : CVE-2026-10028

CVE.ORG link : CVE-2026-10028

JSON object : View

Products Affected

No product.

CWE

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

{"id": "CVE-2026-10028", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10028", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-29T13:17:50.618059Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "glib-networking", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "glib-networking", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "glib-networking", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "glib-networking", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "glib-networking", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-05-28T23:16:44.213", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-10028", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2465152", "source": "secalert@redhat.com"}, {"url": "https://gitlab.gnome.org/GNOME/glib-networking/-/work_items/231", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application that uses glib-networking with the GnuTLS backend enabled and performs certificate verification. This crafted chain, which contains circular issuer relationships, can cause an infinite loop during certificate verification. The unbounded traversal consumes excessive CPU resources, leading to a denial of service for the affected process or worker."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en glib-networking. Un atacante remoto puede explotar esta vulnerabilidad al presentar una cadena de certificados especialmente dise\u00f1ada a una aplicaci\u00f3n que utiliza glib-networking con el backend de GnuTLS habilitado y que realiza la verificaci\u00f3n de certificados. Esta cadena dise\u00f1ada, que contiene relaciones de emisor circulares, puede causar un bucle infinito durante la verificaci\u00f3n de certificados. El recorrido ilimitado consume recursos excesivos de CPU, lo que lleva a una denegaci\u00f3n de servicio para el proceso o trabajador afectado."}], "lastModified": "2026-07-21T10:10:00.103", "sourceIdentifier": "secalert@redhat.com"}