openeuler-ci-botWelcome To openEuler Community
Hey @fundawang , thanks for your contribution to the community.
Bot Usage Manual
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands. You can self-configure the PR merge rules for this repository. For more details, please refer to Here.
Contact Guide
If you have any questions, please contact the SIG: GNOME ,
and any of the maintainers: @dwl301, @lw520203, @openbot, @robert-xingwang, @t_feng, @yanan-rock, @zhang__3125 ,
and any of the committers: @lvgenggeng, @technology208 .
/get-cve
@yangwei999 CVE信息从NVD同步失败, 请稍后重试, 或者数据源不存在.
openeuler-ci-bot✅ CVE 修复已由现有 PR 覆盖（同一方案）
CVE: CVE-2026-103963
针对分支: master
修复 PR: https://gitcode.com/src-openeuler/glib-networking/merge_requests/76
说明:
- 本仓库当期已有同方案的修复 PR，本 CVE 的修复已包含其中，无需重复提交
- 此结论仅针对上述分支；其他分支是否受影响请维护者结合各分支实际情况判断
此评论由 Claude Agent Team 自动生成
✅ CVE 修复已由现有 PR 覆盖（同一方案）
CVE: CVE-2026-103963
针对分支: master
修复 PR: https://gitcode.com/src-openeuler/glib-networking/merge_requests/76
说明:
- 本仓库当期已有同方案的修复 PR，本 CVE 的修复已包含其中，无需重复提交
- 此结论仅针对上述分支；其他分支是否受影响请维护者结合各分支实际情况判断
此评论由 Claude Agent Team 自动生成
✅ CVE 修复已由现有 PR 覆盖（同一方案）
CVE: CVE-2026-103963
针对分支: master
修复 PR: https://gitcode.com/src-openeuler/glib-networking/merge_requests/76
说明:
- 本仓库当期已有同方案的修复 PR，本 CVE 的修复已包含其中，无需重复提交
- 此结论仅针对上述分支；其他分支是否受影响请维护者结合各分支实际情况判断
此评论由 Claude Agent Team 自动生成
影响性分析说明：A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).
openEuler评分：
BaseScore：7.5
Vector：CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
受影响版本排查(受影响/不受影响)：
1.master(2.90.0):受影响
2.openEuler-20.03-LTS-SP4(2.62.4):不受影响
3.openEuler-22.03-LTS-SP4(2.68.1):不受影响
4.openEuler-24.03-LTS-Next(2.78.0):受影响
5.openEuler-24.03-LTS-SP1(2.78.0):受影响
6.openEuler-24.03-LTS-SP3(2.78.0):受影响
7.openEuler-24.03-LTS-SP4(2.78.0):受影响
修复是否涉及abi变化(是/否)：
1.master(2.90.0):否
2.openEuler-20.03-LTS-SP4(2.62.4):否
3.openEuler-22.03-LTS-SP4(2.68.1):否
4.openEuler-24.03-LTS-Next(2.78.0):否
5.openEuler-24.03-LTS-SP1(2.78.0):否
6.openEuler-24.03-LTS-SP3(2.78.0):否
7.openEuler-24.03-LTS-SP4(2.78.0):否
原因说明：
1.master(2.90.0):正常修复
2.openEuler-20.03-LTS-SP4(2.62.4):不受影响-漏洞代码不存在
3.openEuler-22.03-LTS-SP4(2.68.1):不受影响-漏洞代码不存在
4.openEuler-24.03-LTS-Next(2.78.0):正常修复
5.openEuler-24.03-LTS-SP1(2.78.0):正常修复
6.openEuler-24.03-LTS-SP3(2.78.0):正常修复
7.openEuler-24.03-LTS-SP4(2.78.0):正常修复
@ 经过 cve-manager 解析, 已分析的内容如下表所示:
| 状态 | 分析项目 | 内容 |
|---|---|---|
| 已分析 | 1.影响性分析说明 | A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS). |
| 已分析 | 2.openEulerScore | 7.5 |
| 已分析 | 3.openEulerVector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 已分析 | 4.受影响版本排查 | master:受影响,openEuler-20.03-LTS-SP4:不受影响,openEuler-22.03-LTS-SP4:不受影响,openEuler-24.03-LTS-Next:受影响,openEuler-24.03-LTS-SP1:受影响,openEuler-24.03-LTS-SP3:受影响,openEuler-24.03-LTS-SP4:受影响 |
| 已分析 | 5.是否涉及abi变化 | master:否,openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP4:否,openEuler-24.03-LTS-Next:否,openEuler-24.03-LTS-SP1:否,openEuler-24.03-LTS-SP3:否,openEuler-24.03-LTS-SP4:否 |
| 已分析 | 6.原因说明 | master:正常修复,openEuler-20.03-LTS-SP4:不受影响-漏洞代码不存在,openEuler-22.03-LTS-SP4:不受影响-漏洞代码不存在,openEuler-24.03-LTS-Next:正常修复,openEuler-24.03-LTS-SP1:正常修复,openEuler-24.03-LTS-SP3:正常修复,openEuler-24.03-LTS-SP4:正常修复 |
请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.
经过cve-manager解析，所有PR均已合入
经过cve-manager解析，所有PR均已合入
一、漏洞信息
漏洞编号：CVE-2026-103963
漏洞归属组件：glib-networking
漏洞归属的版本：2.62.4,2.66.0,2.68.1,2.72.0,2.74.0,2.78.0,2.80.1,2.90.0
CVSS评分：
BaseScore：N/A None
Vector：
漏洞简述：
漏洞公开时间：
漏洞创建时间：2026-10-26 15:03:10
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2026-103963
更多参考(点击展开)
无
漏洞分析指导链接：
https://atomgit.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
其他
漏洞补丁信息：
详情(点击展开)
无
二、漏洞分析结构反馈
影响性分析说明：
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).
openEuler评分：
7.5
Vector：CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
受影响版本排查(受影响/不受影响)：
1.master(2.90.1):受影响
2.openEuler-20.03-LTS-SP4(2.62.4):不受影响
3.openEuler-22.03-LTS-SP4(2.68.1):不受影响
4.openEuler-24.03-LTS-Next(2.78.0):受影响
5.openEuler-24.03-LTS-SP1(2.78.0):受影响
6.openEuler-24.03-LTS-SP3(2.78.0):受影响
7.openEuler-24.03-LTS-SP4(2.78.0):受影响
修复是否涉及abi变化(是/否)：
1.master(2.90.1):否
2.openEuler-20.03-LTS-SP4(2.62.4):否
3.openEuler-22.03-LTS-SP4(2.68.1):否
4.openEuler-24.03-LTS-Next(2.78.0):否
5.openEuler-24.03-LTS-SP1(2.78.0):否
6.openEuler-24.03-LTS-SP3(2.78.0):否
7.openEuler-24.03-LTS-SP4(2.78.0):否
原因说明：
1.master(2.90.1):正常修复
2.openEuler-20.03-LTS-SP4(2.62.4):不受影响-漏洞代码不存在
3.openEuler-22.03-LTS-SP4(2.68.1):不受影响-漏洞代码不存在
4.openEuler-24.03-LTS-Next(2.78.0):正常修复
5.openEuler-24.03-LTS-SP1(2.78.0):正常修复
6.openEuler-24.03-LTS-SP3(2.78.0):正常修复
7.openEuler-24.03-LTS-SP4(2.78.0):正常修复