Your message dated Sat, 19 Sep 2026 11:05:58 +0000
with message-id <[email protected]>
and subject line Bug#1138235: fixed in glib-networking 2.90.0-1
has caused the Debian Bug report #1138235,
regarding glib-networking: CVE-2026-10028
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1138235: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138235
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: glib-networking
Version: 2.80.1-1
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/glib-networking/-/work_items/231
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for glib-networking.
CVE-2026-10028[0]:
| A flaw was found in glib-networking. A remote attacker can exploit
| this vulnerability by presenting a specially crafted certificate
| chain to an application that uses glib-networking with the GnuTLS
| backend enabled and performs certificate verification. This crafted
| chain, which contains circular issuer relationships, can cause an
| infinite loop during certificate verification. The unbounded
| traversal consumes excessive CPU resources, leading to a denial of
| service for the affected process or worker.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-10028
https://www.cve.org/CVERecord?id=CVE-2026-10028
[1] https://gitlab.gnome.org/GNOME/glib-networking/-/work_items/231
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: glib-networking
Source-Version: 2.90.0-1
Done: Jeremy Bícha <[email protected]>
We believe that the bug you reported is fixed in the latest version of
glib-networking, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Jeremy Bícha <[email protected]> (supplier of updated glib-networking package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 19 Sep 2026 12:30:11 +0200
Source: glib-networking
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 2.90.0-1
Distribution: unstable
Urgency: high
Maintainer: Debian GNOME Maintainers
<[email protected]>
Changed-By: Jeremy Bícha <[email protected]>
Closes: 1138235
Changes:
glib-networking (2.90.0-1) unstable; urgency=high
.
* New upstream release
- SECURITY UPDATE - Fix infinite loop in certificate verification
- CVE-2026-10028 (Closes: #1138235)
- SECURITY UPDATE - Fix out-of-bounds read through
tls/openssl/gtlsclientconnection-openssl.c via
g_tls_client_connection_openssl_get_property()
- CVE-2026-2574
- SECURITY UPDATE - Fix out-of-bounds read through
tls/openssl/gtlsclientconnection-openssl.c via
g_tls_client_connection_openssl_get_property()
- CVE-2026-60018
- SECURITY UPDATE - Fix uninitialized memory dereference through
g_tls/openssl/gtlscbio.c via
g_tls_bio_new_from_iostream() and g_tls_bio_new_from_datagram_based()
- CVE-2026-60019
* Opt into Salsa CI
* Update debhelper compat to 14
* Update Standards Version to 4.7.4
* Misc packaging updates
Checksums-Sha1:
f5d9ceab3ff619db8438bf3bc69e725acb129286 2411 glib-networking_2.90.0-1.dsc
275c658bb2c27bd8a03e0b3142dd2a203dcbcb81 290168
glib-networking_2.90.0.orig.tar.xz
54a6437df46191cf0852a2f82e83ff5354fae690 12740
glib-networking_2.90.0-1.debian.tar.xz
6a8f0a24e8aa32301fdd55a7ff5902041471c759 11432
glib-networking_2.90.0-1_source.buildinfo
Checksums-Sha256:
3846cfbf8853c399f90fbe78b205c486e430fef12bb0cb295755d789d5332f9f 2411
glib-networking_2.90.0-1.dsc
83a75e3d9c36b66ee86d3281c2fc997816101968a5126ba322b2acb9a74dd8c0 290168
glib-networking_2.90.0.orig.tar.xz
a8d8fbdfc51a2f21c6aea1bf651ffa9bb787380051672d3e4fd28435c7c8e44c 12740
glib-networking_2.90.0-1.debian.tar.xz
816394e00963fbce08240cd76a761f139fbef66e24ddd0c43c7e382512444332 11432
glib-networking_2.90.0-1_source.buildinfo
Files:
8d194d12467d3ba9adf0256f63a99d40 2411 libs optional
glib-networking_2.90.0-1.dsc
87d6ce1d1dab10fb20ea783ca55e40a1 290168 libs optional
glib-networking_2.90.0.orig.tar.xz
edcfd467f8f92be6ee34484dc82f3e84 12740 libs optional
glib-networking_2.90.0-1.debian.tar.xz
8ecdbb3107f03a4fdb9340bc4dc38c48 11432 libs optional
glib-networking_2.90.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmquZqEACgkQ5mx3Wuv+
bH2BhRAA2KmkJ2ik5foVa6clLBPqKN3B00jssbc0zMmInT4FZbiWHdor9lhDTpRG
igU+xeE2p+kq0j7HypllKhiyF5gqa/3SvM+jyMtEjvsREDqfMRtzHaqp5xJqoizX
cdM+Oj+9UVdUS2NCO01V63SY26khwwQbkP2Izu1r9ymFKJCcmgwMwqaFS0jyexN5
9slVoHog7N00lxkIGCkLa5+82po6ciBqLNcEoKPZrWZoZd5e9lEz3AfKMFmhjAgc
y7jWX6RfiJnJTNl7eqMZVVoS1snAEzUCgjEgitIQp0nlZwosM52KYMTJKwMaunlO
Twpd0wMqD/bUSdsM2eFbZtuls/h2ZWTBbW9+hBylrfFUUVuMLScTqkVTpkDDkiOy
T+3ItzLlt+0pPa7hBt5CbYM4VoIiCLhC1L5DOQIPcwqiTbAdcZd3NKSAM761aoda
FNJwwxo/fXFbP31Xt0Y2UfDAuvkYQlbOBPy6J3U0uhSymopqlhlyXyb+zQcTz5Gw
ViLx3QgsIp5qOykNM3PkxeJFE1IT+HHUeThs8BURQqJGjx2chCT95aK75kV8eivB
W6gdIAwOwebShGc23fm1dlzaPcvoRvfy5Xg3/IaezFFvS2vEMB0p1YjuRAC90Tmq
KCsqDmYK1vId08TpVKhQwIbPEBRMx58Hu7kl18EOahhdO4E/Yiw=
=EBzA
-----END PGP SIGNATURE-----
pgpJmAT4DS5Gt.pgp
Description: PGP signature
--- End Message ---
