Moderate Security Vulnerability in glib2 Package: Integer Overflow in g_escape_uri_string()
Summary
ALSA-2026:0936: Moderate: glib2 security update. Affects glib2 versions < 2.68.4-18.el9_7.1. Fixed in 2.68.4-18.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GLib is a fundamental library that provides core application building blocks for C libraries and applications. It includes the core object system used in GNOME, a main loop implementation, and a variety of utility functions for strings and common data structures. This library is essential for many applications in the Linux ecosystem, particularly those related to GNOME. The vulnerability in question affects the glib2 package, which is widely used in various applications, making it critical to address.
Vulnerability Detail
The vulnerability identified as CVE-2025-13601 is an integer overflow issue in the g_escape_uri_string() function of the glib2 library. This flaw can potentially allow an attacker to exploit the overflow, leading to unexpected behavior or even arbitrary code execution in applications that utilize this function. The impact of this vulnerability can be severe, particularly in applications that handle untrusted input, as it may lead to security breaches or system instability.
How To Fix
Minimum fixed version
2.68.4-18.el9_7.1
This is the first release that contains the fix.
sudo dnf update glib2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if immediate updating is not feasible, consider restricting the input to the g_escape_uri_string() function to prevent potential exploitation. However, this is not a permanent solution and should only be used until the package can be updated.
Conclusion
The glib2 security vulnerability identified as CVE-2025-13601 poses a moderate risk due to an integer overflow in the g_escape_uri_string() function. It is crucial to update the affected packages to the patched version to mitigate potential security risks. Implementing workarounds can provide temporary relief, but a permanent fix through updates is recommended.
See every vulnerability recorded for glib2 →
FAQ
CVE-2025-13601 is a security vulnerability in the glib2 library that involves an integer overflow in the g_escape_uri_string() function.
If your application uses the glib2 library and the g_escape_uri_string() function, it may be susceptible to exploitation, leading to potential security breaches.
You can implement input restrictions as a temporary workaround until you are able to update to the patched version.
For detailed information, refer to the CVE page associated with CVE-2025-13601, which provides insights into the vulnerability's impact and technical details.
Vulert allows you to monitor and alert in real-time for open-source vulnerabilities using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for glib2.
