Is CVE-2025-60019 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-60019 being exploited in the wild.

How severe is CVE-2025-60019?

Low severity, with a CVSS score of 3.7, published 25 September 2025.

Which products and versions are affected?

Gnome Glib-Networking 2.60 to 2.80.1.

Is there a fix for CVE-2025-60019?

A patch was published on 2025-09-08: Fixed in version 2.80.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-60019 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-60019?

Check whether you run Gnome Glib-Networking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-60019: GNOME glib-networking uninitialized pointer dereference in OpenSSL backend

CVE-2025-60019 · Severity: low · CVSS 3.7 · Published 2025-09-25

glib-networking is a software component used by many Linux applications to handle secure internet connections. A flaw in its OpenSSL-based security module could cause an application to crash if the system runs out of memory while establishing a secure connection. This could lead to a service outage or, in rare cases, the exposure of small amounts of technical data from the computer's memory.

Technologies: Gnome Glib-Networking. Vendors: Gnome.

Quick answers

Is CVE-2025-60019 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-60019 being exploited in the wild.
How severe is CVE-2025-60019?: Low severity, with a CVSS score of 3.7, published 25 September 2025.
Which products and versions are affected?: Gnome Glib-Networking 2.60 to 2.80.1.
Is there a fix for CVE-2025-60019?: A patch was published on 2025-09-08: Fixed in version 2.80.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-60019 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-60019?: Check whether you run Gnome Glib-Networking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A NULL pointer dereference and uninitialized memory access vulnerability exists in glib-networking's OpenSSL backend within tls/openssl/gtlsbio.c. The functions g_tls_bio_new_from_iostream and g_tls_bio_new_from_datagram_based fail to verify the success of g_tls_bio_alloc before dereferencing the gbio pointer. If BIO_new fails (e.g., during memory exhaustion), the gbio pointer remains uninitialized, leading to a segmentation fault or potential disclosure of stack data. This issue specifically affects the OpenSSL backend, which is not the default for most Linux distributions. The vulnerability was fixed in version 2.80.2.

Affected products

GNOME glib-networking 2.60 to 2.80.1

Timeline

2025-08-16: disclosed: Reported via YesWeHack
2025-09-08: patched: Fixed in version 2.80.2
2025-09-25: advisory: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.