CVE-2026-10028 is a vulnerability in glib-networking on Red Hat Enterprise Linux 10 where a remote attacker can trigger an infinite loop during certificate verification. This occurs when the application uses glib-networking with the GnuTLS backend enabled and processes a specially crafted certificate chain containing circular issuer relationships. The infinite loop causes unbounded traversal of the certificate chain, consuming excessive CPU resources and resulting in denial of service for the affected process or worker. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, and impact limited to availability.

The vulnerability allows remote attackers to cause a denial of service condition by exhausting CPU resources through an infinite loop in certificate verification. There is no impact on confidentiality or integrity. The affected process or worker becomes unavailable due to resource exhaustion.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-10028 for current remediation guidance. Until a fix is available, consider limiting exposure to untrusted certificate chains or applying application-level mitigations to detect and handle circular certificate chains if possible.