CVE-2025-60019CWE-476

CVE-2025-60019

Low · published September 25, 2025

CVSS v3.1

3.7

EPSS

Percentile

27.9

In the wild

Unconfirmed

What it is

glib-networking's OpenSSL backend fails to properly check the return value of memory allocation routines. An out of memory condition could potentially result in writing to an invalid memory location.

The record

Technical detail

CVSS v3.1: 3.7 · LOW
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0: Not supplied
EPSS: 0.00355 · 27.9th percentile
Weakness: CWE-476 · NULL Pointer Dereference
Published: 2025-09-25T20:15Z

References (3)

https://access.redhat.com/security/cve/CVE-2025-60019 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2398140 · [email protected]https://gitlab.gnome.org/GNOME/glib-networking/-/issues/227 · [email protected]

EPSS history

Timeline

25 SEP 15:53Z
Glib-networking: uninitialized memory dereferences on glib-networking through glib-networking/tls/openssl/gtlsbio.c via g_tls_bio_new_from_iostream() and g_tls_bio_new_from_datagram_based()
cvelistv5