---
id: CVE-2026-10028
title: >-
  Glib-networking: infinite loop in glib-networking gnutls backend allows remote
  denial of service via circular certificate chain
summary: >-
  A flaw was found in glib-networking. A remote attacker can exploit this
  vulnerability by presenting a specially crafted certificate chain to an
  application that uses glib-networking with the GnuTLS backend enabled and
  performs certificat…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-835
vendor: Red Hat
product: glib-networking
affected:
  - glib-networking (all versions)
  - glib-networking (all versions)
  - glib-networking (all versions)
  - glib-networking (all versions)
  - glib-networking (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-05-29T13:17:50.618059Z'
published: '2026-05-28'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:49:17.222Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-10028'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-10028'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2465152'
    label: RHBZ#2465152
  - url: 'https://gitlab.gnome.org/GNOME/glib-networking/-/work_items/231'
tags:
  - cve.org
epss: 0.00181
epssPercentile: 0.07722
ingestedAt: '2026-11-06T18:00:12.501Z'
---

## Overview

A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application that uses glib-networking with the GnuTLS backend enabled and performs certificate verification. This crafted chain, which contains circular issuer relationships, can cause an infinite loop during certificate verification. The unbounded traversal consumes excessive CPU resources, leading to a denial of service for the affected process or worker.

## Affected

- `glib-networking (all versions)`
- `glib-networking (all versions)`
- `glib-networking (all versions)`
- `glib-networking (all versions)`
- `glib-networking (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.