CVE-2025-13601

high

Published 2026-01-21 · Modified 2026-01-22

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

7.7

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

7.7

Description

RHSA-2026:0991: glib2 security update (Moderate)

Predictions

Exploit likelihood

75%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Red Hat Errata — Red Hat Inc. · View original ↗ · Open-Errata-API

Description glib: Integer overflow in in g_escape_uri_string() Red Hat statement Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. CVSS v3: 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Errata / fixed releases…

Workaround

for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Description

glib: Integer overflow in in g_escape_uri_string()

Red Hat statement

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

CVSS v3: 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)

Errata / fixed releases

Product	Package	Advisory	Released
Red Hat Enterprise Linux 10	`glib2-0:2.80.4-10.el10_1.12`	RHSA-2026:0975	2026-01-22T00:00:00Z
Red Hat Enterprise Linux 10	`mingw-glib2-0:2.87.0-1.el10`	RHSA-2026:18344	2026-05-19T00:00:00Z
Red Hat Enterprise Linux 10.0 Extended Update Support	`glib2-0:2.80.4-4.el10_0.8`	RHSA-2026:1327	2026-01-27T00:00:00Z
Red Hat Enterprise Linux 7 Extended Lifecycle Support	`glib2-0:2.56.1-11.el7_9`	RHSA-2026:1608	2026-02-02T00:00:00Z
Red Hat Enterprise Linux 8	`glib2-0:2.56.4-168.el8_10`	RHSA-2026:0991	2026-01-22T00:00:00Z
Red Hat Enterprise Linux 8.2 Advanced Update Support	`glib2-0:2.56.4-8.el8_2.4`	RHSA-2026:1627	2026-02-02T00:00:00Z
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	`glib2-0:2.56.4-10.el8_4.4`	RHSA-2026:1626	2026-02-02T00:00:00Z
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	`glib2-0:2.56.4-10.el8_4.4`	RHSA-2026:1626	2026-02-02T00:00:00Z
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	`glib2-0:2.56.4-158.el8_6.4`	RHSA-2026:1624	2026-02-02T00:00:00Z
Red Hat Enterprise Linux 8.6 Telecommunications Update Service	`glib2-0:2.56.4-158.el8_6.4`	RHSA-2026:1624	2026-02-02T00:00:00Z
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	`glib2-0:2.56.4-158.el8_6.4`	RHSA-2026:1624	2026-02-02T00:00:00Z
Red Hat Enterprise Linux 8.8 Telecommunications Update Service	`glib2-0:2.56.4-164.el8_8`	RHSA-2026:1625	2026-02-02T00:00:00Z
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	`glib2-0:2.56.4-164.el8_8`	RHSA-2026:1625	2026-02-02T00:00:00Z
Red Hat Enterprise Linux 9	`glib2-0:2.68.4-18.el9_7.1`	RHSA-2026:0936	2026-01-21T00:00:00Z
Red Hat Enterprise Linux 9	`mingw-glib2-0:2.78.6-3.el9`	RHSA-2026:18705	2026-05-19T00:00:00Z
Red Hat Enterprise Linux 9	`glib2-0:2.68.4-18.el9_7.1`	RHSA-2026:0936	2026-01-21T00:00:00Z
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	`glib2-0:2.68.4-5.el9_0.4`	RHSA-2026:1323	2026-01-27T00:00:00Z
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	`glib2-0:2.68.4-7.el9_2.4`	RHSA-2026:1324	2026-01-27T00:00:00Z
Red Hat Enterprise Linux 9.4 Extended Update Support	`glib2-0:2.68.4-14.el9_4.5`	RHSA-2026:1326	2026-01-27T00:00:00Z
Red Hat Enterprise Linux 9.6 Extended Update Support	`glib2-0:2.68.4-16.el9_6.4`	RHSA-2026:1465	2026-01-28T00:00:00Z
Red Hat OpenShift Container Platform 4.12	`rhcos-412.86.202602021310-0`	RHSA-2026:2064	2026-02-13T00:00:00Z
Red Hat OpenShift Container Platform 4.13	`rhcos-413.92.202602240113-0`	RHSA-2026:3415	2026-03-05T00:00:00Z
Red Hat OpenShift Container Platform 4.14	`rhcos-414.92.202602171627-0`	RHSA-2026:2974	2026-02-26T00:00:00Z
Red Hat OpenShift Container Platform 4.15	`rhcos-415.92.202603101737-0`	RHSA-2026:4419	2026-03-19T00:00:00Z
Red Hat OpenShift Container Platform 4.16	`rhcos-416.94.202602101357-0`	RHSA-2026:2659	2026-02-18T00:00:00Z
Red Hat OpenShift Container Platform 4.17	`rhcos-417.94.202602090846-0`	RHSA-2026:2671	2026-02-18T00:00:00Z
Red Hat OpenShift Container Platform 4.18	`rhcos-418.94.202602022246-0`	RHSA-2026:2072	2026-02-11T00:00:00Z
Red Hat OpenShift Container Platform 4.19	`rhcos-4.19.9.6.202602112047-0`	RHSA-2026:2633	2026-02-18T00:00:00Z
Red Hat Ceph Storage 8	`rhceph/rhceph-8-rhel9:1769512383`	RHSA-2026:1652	2026-02-02T00:00:00Z
Red Hat Discovery 2	`discovery/discovery-server-rhel9:1769104765`	RHSA-2026:1736	2026-02-02T00:00:00Z
Red Hat Discovery 2	`discovery/discovery-ui-rhel9:1769111774`	RHSA-2026:1736	2026-02-02T00:00:00Z
Red Hat Hardened Images	`glib2-main-2.88.0-1.1.hum1`	RHSA-2026:7461	2026-04-10T00:00:00Z
Red Hat Insights proxy 1.5	`insights-proxy/insights-proxy-container-rhel9:1770740405`	RHSA-2026:2485	2026-02-10T00:00:00Z
Red Hat Update Infrastructure 5	`rhui5/cds-rhel9:1770808689`	RHSA-2026:2563	2026-02-11T00:00:00Z
Red Hat Update Infrastructure 5	`rhui5/haproxy-rhel9:1770807477`	RHSA-2026:2563	2026-02-11T00:00:00Z
Red Hat Update Infrastructure 5	`rhui5/installer-rhel9:1770646925`	RHSA-2026:2563	2026-02-11T00:00:00Z
Red Hat Update Infrastructure 5	`rhui5/rhua-rhel9:1770808765`	RHSA-2026:2563	2026-02-11T00:00:00Z

Package state

Product	Package	State
Red Hat Enterprise Linux 6	`glib2`	Out of support scope
Red Hat Enterprise Linux 8	`mingw-glib2`	Will not fix

Apply commands

bash fix

Apply RHSA-2026:0975 for Red Hat Enterprise Linux 10

yum update -y glib2
# or:
dnf upgrade -y glib2

OS impact

OS	Version	Status	Fixed in
rocky	8	fixed
rhel	9	fixed
debian	bookworm	fixed	`2.74.6-2+deb12u8`
debian	bullseye	fixed	`2.66.8-1+deb11u7`
debian	forky	fixed	`2.86.3-1`
debian	sid	fixed	`2.86.3-1`
debian	trixie	fixed	`2.84.4-3~deb13u2`
sles		affected
rocky	9	fixed
rhel	9.0	affected
rhel	10.0	affected
rhel	8.0	affected
rhel	9.2	affected
rhel	9.4	affected
rhel	9.6	affected
almalinux	9	fixed	`glib2-tests-2.68.4-18.el9_7.1.aarch64.rpm`
almalinux	8	fixed	`glib2-2.56.4-168.el8_10.i686.rpm`
rhel	8	fixed

Application impact

Vendor	Product	Versions	Fixed
redhat	codeready_linux_builder	`9.0`
redhat	codeready_linux_builder_for_ibm_z_systems	`9.0_s390x`
redhat	codeready_linux_builder_for_power_little_endian	`9.0_ppc64le`
redhat	codeready_linux_builder_for_x86_64	`9.0`
redhat	codeready_linux_builder_for_arm64	`10.0`
redhat	codeready_linux_builder_for_ibm_z_systems	`10.0_s390x`
redhat	codeready_linux_builder_for_power_little_endian	`10.0_ppc64le`
redhat	codeready_linux_builder_for_x86_64	`10.0`
redhat	codeready_linux_builder_for_arm64	`8.0`
redhat	codeready_linux_builder_for_ibm_z_systems	`8.0_s390x`
redhat	codeready_linux_builder_for_power_little_endian	`8.0_ppc64le`
redhat	codeready_linux_builder_for_x86_64	`8.0`
redhat	codeready_linux_builder_for_arm64_eus	`9.4`
redhat	codeready_linux_builder_for_ibm_z_systems	`9.4_s390x`
redhat	codeready_linux_builder_for_power_little_endian	`9.4_ppc64le`
redhat	codeready_linux_builder_for_x86_64	`9.4`
redhat	codeready_linux_builder_for_arm64_eus	`10.0`
redhat	codeready_linux_builder_for_ibm_z_systems_eus	`10.0_s390x`
redhat	codeready_linux_builder_for_power_little_endian_eus	`10.0_ppc64le`
redhat	codeready_linux_builder_for_x86_64_eus	`10.0`
redhat	codeready_linux_builder_for_arm64	`9.6`
redhat	codeready_linux_builder_for_ibm_z_systems	`9.6_s390x`
redhat	codeready_linux_builder_for_power_little_endian	`9.6_ppc64le`
redhat	codeready_linux_builder_for_x86_64	`9.6`
redhat	ceph_storage	`8.0`
redhat	discovery	`2.0`
gnome	glib	`{"endExcluding":"2.86.3"}`	`2.86.3`
redhat	openshift_container_platform	`4.12`
redhat	openshift_container_platform	`4.16`
redhat	openshift_container_platform	`4.17`
redhat	openshift_container_platform	`4.18`
redhat	openshift_container_platform	`4.19`
redhat	openshift_container_platform_for_arm64	`4.12`
redhat	openshift_container_platform_for_arm64	`4.16`
redhat	openshift_container_platform_for_arm64	`4.17`
redhat	openshift_container_platform_for_arm64	`4.18`
redhat	openshift_container_platform_for_arm64	`4.19`
redhat	openshift_container_platform_for_ibm_z	`4.12`
redhat	openshift_container_platform_for_ibm_z	`4.16`
redhat	openshift_container_platform_for_ibm_z	`4.17`
redhat	openshift_container_platform_for_ibm_z	`4.18`
redhat	openshift_container_platform_for_ibm_z	`4.19`
redhat	openshift_container_platform_for_linuxone	`4.12`
redhat	openshift_container_platform_for_linuxone	`4.16`
redhat	openshift_container_platform_for_linuxone	`4.17`
redhat	openshift_container_platform_for_linuxone	`4.18`
redhat	openshift_container_platform_for_linuxone	`4.19`
redhat	openshift_container_platform_for_power	`4.12`
redhat	openshift_container_platform_for_power	`4.16`
redhat	openshift_container_platform_for_power	`4.17`
redhat	openshift_container_platform_for_power	`4.18`
redhat	openshift_container_platform_for_power	`4.19`

References

CWEs

CWE-190

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.