Your message dated Sun, 20 Sep 2026 07:42:05 +0000
with message-id <[email protected]>
and subject line Bug#1138235: fixed in glib-networking 2.90.0-2
has caused the Debian Bug report #1138235,
regarding glib-networking: CVE-2026-10028
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1138235: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138235
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: glib-networking
Version: 2.80.1-1
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/glib-networking/-/work_items/231
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for glib-networking.
CVE-2026-10028[0]:
| A flaw was found in glib-networking. A remote attacker can exploit
| this vulnerability by presenting a specially crafted certificate
| chain to an application that uses glib-networking with the GnuTLS
| backend enabled and performs certificate verification. This crafted
| chain, which contains circular issuer relationships, can cause an
| infinite loop during certificate verification. The unbounded
| traversal consumes excessive CPU resources, leading to a denial of
| service for the affected process or worker.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-10028
https://www.cve.org/CVERecord?id=CVE-2026-10028
[1] https://gitlab.gnome.org/GNOME/glib-networking/-/work_items/231
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: glib-networking
Source-Version: 2.90.0-2
Done: Jeremy Bícha <[email protected]>
We believe that the bug you reported is fixed in the latest version of
glib-networking, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Jeremy Bícha <[email protected]> (supplier of updated glib-networking package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 20 Sep 2026 09:18:39 +0200
Source: glib-networking
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 2.90.0-2
Distribution: unstable
Urgency: high
Maintainer: Debian GNOME Maintainers
<[email protected]>
Changed-By: Jeremy Bícha <[email protected]>
Closes: 1138235
Changes:
glib-networking (2.90.0-2) unstable; urgency=high
.
* New upstream release
- SECURITY UPDATE - Fix infinite loop in certificate verification
- CVE-2026-10028 (Closes: #1138235)
- SECURITY UPDATE - Fix out-of-bounds read through
tls/openssl/gtlsclientconnection-openssl.c via
g_tls_client_connection_openssl_get_property()
- CVE-2026-2574
- SECURITY UPDATE - Fix out-of-bounds read through
tls/openssl/gtlsclientconnection-openssl.c via
g_tls_client_connection_openssl_get_property()
- CVE-2025-60018
- SECURITY UPDATE - Fix uninitialized memory dereference through
g_tls/openssl/gtlscbio.c via
g_tls_bio_new_from_iostream() and g_tls_bio_new_from_datagram_based()
- CVE-2025-60019
* Opt into Salsa CI
* Update debhelper compat to 14
* Update Standards Version to 4.7.4
* Misc packaging updates
Checksums-Sha1:
6fce2703eb3f49a8f5c3ab4c5223dfa6afcf6040 2411 glib-networking_2.90.0-2.dsc
275c658bb2c27bd8a03e0b3142dd2a203dcbcb81 290168
glib-networking_2.90.0.orig.tar.xz
744ac9e9d96b4fb3560bdb9c5e5837d21173e255 12736
glib-networking_2.90.0-2.debian.tar.xz
1dc4ce599cee2288da5781460b21efbcf6a93779 11432
glib-networking_2.90.0-2_source.buildinfo
Checksums-Sha256:
8d4ee18104dfb4538cb3e4eac285a4c7b73cc9d87fa8352c2c9bb46537319d53 2411
glib-networking_2.90.0-2.dsc
83a75e3d9c36b66ee86d3281c2fc997816101968a5126ba322b2acb9a74dd8c0 290168
glib-networking_2.90.0.orig.tar.xz
2935ad06c9c679b47b4338ff062922a41823ab1cf92eaa8d907f6c7ec727a27c 12736
glib-networking_2.90.0-2.debian.tar.xz
4d2ad1cea750ee031e76ce47c52ad880a0e849ada8830e51ed57f5847b3a40d6 11432
glib-networking_2.90.0-2_source.buildinfo
Files:
5f385e6bebb851b1d9622eed67978eb9 2411 libs optional
glib-networking_2.90.0-2.dsc
87d6ce1d1dab10fb20ea783ca55e40a1 290168 libs optional
glib-networking_2.90.0.orig.tar.xz
ee5f431d7ae854241f9959dca70b0b3c 12736 libs optional
glib-networking_2.90.0-2.debian.tar.xz
a78b34627754de3dd7ba0d38f4db0857 11432 libs optional
glib-networking_2.90.0-2_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmqviOIACgkQ5mx3Wuv+
bH2zvRAA4tBI7/aYyGW4TdtVqNWaCF1hset5TGW4uz94sq5dvtatK6KIFYerHXi7
hT2v7vs2nNAIbOjZlnBDjEWsGHD/F63x9mSXcUgw4BZBvXrdnCSqX6vtfEgJ3z4F
4TNhCPNsxdG1kicrvyiHi5QRcntyI8eyJly4JBJ/xWpQGcZTpf7+nSRWLS0UiUKC
s4crRMktqYg8/ufShDjfILO2cXX0zC6s48Tkfn5ScOAYBs0ZKWZ4GYD323JW52wF
mMtxpf3Onsqk81fGtMnBD1TJ8+xZL4vTCIL8xoGrHCnTSa5urIHmZvMiddbrjvrm
6LcoKn+8TI2FPgoJg03YciH2YdZ2QQSJu4+iQjEfy7nlRn/HLRawSPGeFycW0fL/
9O2XuG+nd1FPC1dfreIdlwBh7TfCNZCGAXLzvs9cPQql+fIGVbyRUuJNR4435EzW
8XInRRKIr1ko2pMI/xnN5GyvBY+3Ojhu3usEEhfnPLx6yov3FplASxEfoPaJKaaO
tj2mUNdb5HjL03hoKdlqg9T1nwNWo7Hn7Q4w0q6bFKZaXxx6wYovzZKnyF/k3nbc
t/b+sVuSNLDiDVGcfTwd5drzOwYX/fggRDsPw9tAAS53OB43wXfQG575zL18IicR
VXaJLKf7wgWnMNUEd6jE5wQP/RwJ3brh4Nxz4oTF4y71h1etiI8=
=LxRn
-----END PGP SIGNATURE-----
pgpwubBKlRUvD.pgp
Description: PGP signature
--- End Message ---
