Moderate Vulnerability in glib2 Package: Integer Overflow in g_escape_uri_string()
Summary
ALSA-2026:0975: Moderate: glib2 security update. Affects glib2 versions < 2.80.4-10.el10_1.12. Fixed in 2.80.4-10.el10_1.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GLib is a fundamental library that provides core application building blocks for C libraries and applications. It underpins the GNOME desktop environment and offers essential functionalities such as object systems, main loop implementations, and utility functions for strings and data structures. This library is crucial for developers working within the GNOME ecosystem and other applications that rely on its capabilities.
Vulnerability Detail
The vulnerability identified as CVE-2025-13601 is an integer overflow in the function g_escape_uri_string() within the glib2 package. This flaw can lead to unexpected behavior, potentially allowing an attacker to exploit the overflow to execute arbitrary code or cause a denial of service. The issue arises from improper handling of input data, which can be manipulated to exceed the expected range, resulting in an overflow condition.
How To Fix
Minimum fixed version
2.80.4-10.el10_1.12
This is the first release that contains the fix.
sudo dnf update glib2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the input size to the g_escape_uri_string() function to avoid triggering the overflow. However, this is not a permanent solution and should only be used until the package is updated.
Conclusion
The glib2 package has a moderate vulnerability due to an integer overflow in the g_escape_uri_string() function. It is crucial for users to update to the patched version to ensure the security of their applications. Temporary workarounds can be implemented, but they should not replace proper updates.
See every vulnerability recorded for glib2 →
FAQ
CVE-2025-13601 refers to an integer overflow vulnerability in the g_escape_uri_string() function of the glib2 package, which can lead to security risks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability could allow attackers to execute arbitrary code or cause a denial of service, compromising the security and stability of applications using glib2.
Yes, a patch is available in version 2.80.4-10.el10_1.12 of the glib2 package. It is recommended to update to this version to mitigate the risk.
If immediate updates are not possible, consider implementing input size restrictions as a temporary workaround until the package can be updated.
Related vulnerabilities
Recent vulnerabilities recorded for glib2.
