CVE-2026-10028 | Glib-networking: infinite loop in glib-networking gnutls backend allows remote denial of service via circular certificate chain

A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application that uses glib-networking with the GnuTLS backend enabled and performs certificate verification. This crafted chain, which contains circular issuer relationships, can cause an infinite loop during certificate verification. The unbounded traversal consumes excessive CPU resources, leading to a denial of service for the affected process or worker.

Published: 2026-05-28 Last update: 2026-06-17 Assigner: [email protected] Source: [email protected]
NVD Status：Awaiting Analysis，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2026-10028 is rated Low Risk (20.1/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.18%). Monitor for updates and reassess as exploit intelligence or EPSS changes.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2026-10028

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.06% 0.18% +0.12%
2 2026-05-29 — 0.06% —

Full EPSS history (2 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2026-10028

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
4.3 3.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:R)
A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:L)
Might cause slowdowns, glitches, or partial disruption—not a full brick.
 2.8 1.4 [email protected]

Weakness enumeration for CVE-2026-10028

GitHub Security Advisory for CVE-2026-10028

GHSA-qvjg-2vfm-53c7 · Severity: medium — A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by...

OS Trackers for CVE-2026-10028

vendor priority summary link
debian not yet assigned CVE-2026-10028 not yet assigned priority: Debian including 1 source packages (glib-networking), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): open 5. https://security-tracker.debian.org/tracker/CVE-2026-10028
redhat low — https://access.redhat.com/security/cve/CVE-2026-10028
suse medium — https://www.suse.com/security/cve/CVE-2026-10028/
ubuntu medium CVE-2026-10028 medium priority: Ubuntu including 1 source packages (glib-networking), 8 status rows across 8 suites (bionic, focal, jammy, noble, questing, resolute, upstream, xenial): deferred 7, needs-triage 1. https://ubuntu.com/security/CVE-2026-10028

Affected software / configurations for CVE-2026-10028

Vendor Product Version Raw CPE
No affected products in dataset.

References for CVE-2026-10028

cvelogic Threat Intelligence