--- id: CVE-2025-13601 title: >- A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function summary: >- A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would ne… severity: high cvss: 7.7 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H' cwe: - CWE-190 vendor: redhat product: codeready_linux_builder affected: - codeready_linux_builder = 9.0 - codeready_linux_builder_for_ibm_z_systems = 9.0_s390x - codeready_linux_builder_for_power_little_endian = 9.0_ppc64le - codeready_linux_builder_for_x86_64 = 9.0 - enterprise_linux_for_arm_64 = 9.0 - enterprise_linux_for_ibm_z_systems = 9.0_s390x - enterprise_linux_for_power_little_endian = 9.0_ppc64le - enterprise_linux_for_x86_64 = 9.0 - codeready_linux_builder_for_arm64 = 10.0 - codeready_linux_builder_for_ibm_z_systems = 10.0_s390x - codeready_linux_builder_for_power_little_endian = 10.0_ppc64le - codeready_linux_builder_for_x86_64 = 10.0 - enterprise_linux_for_arm_64 = 10.0 - enterprise_linux_for_ibm_z_systems = 10.0_s390x - enterprise_linux_for_power_little_endian = 10.0_ppc64le - enterprise_linux_for_x86_64 = 10.0 - codeready_linux_builder_for_arm64 = 8.0 - codeready_linux_builder_for_ibm_z_systems = 8.0_s390x - codeready_linux_builder_for_power_little_endian = 8.0_ppc64le - codeready_linux_builder_for_x86_64 = 8.0 - enterprise_linux_for_arm_64 = 8.0 - enterprise_linux_for_ibm_z_systems = 8.0_s390x - enterprise_linux_for_power_little_endian = 8.0_ppc64le - enterprise_linux_for_x86_64 = 8.0 - enterprise_linux_for_arm_64 = 9.2 - enterprise_linux_for_ibm_z_systems = 9.2_s390x - enterprise_linux_for_power_little_endian = 9.2_ppc64le - enterprise_linux_for_x86_64 = 9.2 - enterprise_linux_server_aus = 9.2 - codeready_linux_builder_for_arm64_eus = 9.4 - codeready_linux_builder_for_ibm_z_systems = 9.4_s390x - codeready_linux_builder_for_power_little_endian = 9.4_ppc64le - codeready_linux_builder_for_x86_64 = 9.4 - enterprise_linux_for_arm_64 = 9.4 - enterprise_linux_for_ibm_z_systems = 9.4_s390x - enterprise_linux_for_power_little_endian = 9.4_ppc64le - enterprise_linux_for_x86_64 = 9.4 - enterprise_linux_for_x86_64_eus = 9.4 - enterprise_linux_server_aus = 9.4 - enterprise_linux_server_for_power_little_endian = 9.4_ppc64le - enterprise_linux_server_for_power_little_endian_eus = 9.4_ppc64le - codeready_linux_builder_for_arm64_eus = 10.0 - codeready_linux_builder_for_ibm_z_systems_eus = 10.0_s390x - codeready_linux_builder_for_power_little_endian_eus = 10.0_ppc64le - codeready_linux_builder_for_x86_64_eus = 10.0 - enterprise_linux_for_arm_64_eus = 10.0 - enterprise_linux_for_ibm_z_systems_eus = 10.0_s390x - enterprise_linux_for_power_little_endian_eus = 10.0_ppc64le - enterprise_linux_for_x86_64_eus = 10.0 - enterprise_linux_server_for_power_little_endian = 10.0_ppc64le - codeready_linux_builder_for_arm64 = 9.6 - codeready_linux_builder_for_ibm_z_systems = 9.6_s390x - codeready_linux_builder_for_power_little_endian = 9.6_ppc64le - codeready_linux_builder_for_x86_64 = 9.6 - enterprise_linux_for_arm_64 = 9.6 - enterprise_linux_for_ibm_z_systems = 9.6_s390x - enterprise_linux_for_power_little_endian = 9.6_ppc64le - enterprise_linux_for_power_little_endian_eus = 9.6_ppc64le - enterprise_linux_for_x86_64 = 9.6 - enterprise_linux_for_x86_64_eus = 9.6 - enterprise_linux_server_aus = 9.6 - enterprise_linux_server_for_power_little_endian = 9.6_ppc64le - enterprise_linux_for_x86_64 = 8.6 - enterprise_linux_for_x86_64_eus = 8.6 - enterprise_linux_server_aus = 8.6 - enterprise_linux_server_for_power_little_endian = 8.6_ppc64le - enterprise_linux_server_tus = 8.6 - enterprise_linux_for_x86_64 = 8.8 - enterprise_linux_for_x86_64_eus = 8.8 - enterprise_linux_server_for_power_little_endian = 8.8_ppc64le - enterprise_linux_server_tus = 8.8 - enterprise_linux_for_x86_64_eus = 8.4 - enterprise_linux_server_aus = 8.4 - enterprise_linux_server_aus = 8.2 - ceph_storage = 8.0 - discovery = 2.0 - glib < 2.86.3 - openshift_container_platform = 4.12 - openshift_container_platform = 4.16 - openshift_container_platform = 4.17 - openshift_container_platform = 4.18 - openshift_container_platform = 4.19 - openshift_container_platform_for_arm64 = 4.12 - openshift_container_platform_for_arm64 = 4.16 - openshift_container_platform_for_arm64 = 4.17 - openshift_container_platform_for_arm64 = 4.18 - openshift_container_platform_for_arm64 = 4.19 - openshift_container_platform_for_ibm_z = 4.12 - openshift_container_platform_for_ibm_z = 4.16 - openshift_container_platform_for_ibm_z = 4.17 - openshift_container_platform_for_ibm_z = 4.18 - openshift_container_platform_for_ibm_z = 4.19 - openshift_container_platform_for_linuxone = 4.12 - openshift_container_platform_for_linuxone = 4.16 - openshift_container_platform_for_linuxone = 4.17 - openshift_container_platform_for_linuxone = 4.18 - openshift_container_platform_for_linuxone = 4.19 - openshift_container_platform_for_power = 4.12 - openshift_container_platform_for_power = 4.16 - openshift_container_platform_for_power = 4.17 patched: - glib 2.86.3 published: '2025-11-26' updated: '2026-06-25' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-13601' references: - url: 'https://access.redhat.com/errata/RHSA-2026:0936' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:0975' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:0991' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:1323' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:1324' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:1326' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:1327' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:1465' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:1608' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:1624' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:1625' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:1626' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:1627' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:1652' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:1736' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:18344' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:18705' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:2064' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:2072' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:2485' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:2563' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:2633' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:2659' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:2671' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:2974' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:3415' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:4419' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:7461' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2025-13601' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2416741' label: secalert@redhat.com - url: 'https://gitlab.gnome.org/GNOME/glib/-/issues/3827' label: secalert@redhat.com - url: 'https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4914' label: secalert@redhat.com - url: 'https://cert-portal.siemens.com/productcert/html/ssa-253495.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd epss: 0.00322 epssPercentile: 0.22633 ingestedAt: '2026-06-29T13:24:34.612Z' --- ## Overview A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string. ## Affected - `codeready_linux_builder = 9.0` - `codeready_linux_builder_for_ibm_z_systems = 9.0_s390x` - `codeready_linux_builder_for_power_little_endian = 9.0_ppc64le` - `codeready_linux_builder_for_x86_64 = 9.0` - `enterprise_linux_for_arm_64 = 9.0` - `enterprise_linux_for_ibm_z_systems = 9.0_s390x` - `enterprise_linux_for_power_little_endian = 9.0_ppc64le` - `enterprise_linux_for_x86_64 = 9.0` - `codeready_linux_builder_for_arm64 = 10.0` - `codeready_linux_builder_for_ibm_z_systems = 10.0_s390x` - `codeready_linux_builder_for_power_little_endian = 10.0_ppc64le` - `codeready_linux_builder_for_x86_64 = 10.0` - `enterprise_linux_for_arm_64 = 10.0` - `enterprise_linux_for_ibm_z_systems = 10.0_s390x` - `enterprise_linux_for_power_little_endian = 10.0_ppc64le` - `enterprise_linux_for_x86_64 = 10.0` - `codeready_linux_builder_for_arm64 = 8.0` - `codeready_linux_builder_for_ibm_z_systems = 8.0_s390x` - `codeready_linux_builder_for_power_little_endian = 8.0_ppc64le` - `codeready_linux_builder_for_x86_64 = 8.0` - `enterprise_linux_for_arm_64 = 8.0` - `enterprise_linux_for_ibm_z_systems = 8.0_s390x` - `enterprise_linux_for_power_little_endian = 8.0_ppc64le` - `enterprise_linux_for_x86_64 = 8.0` - `enterprise_linux_for_arm_64 = 9.2` - `enterprise_linux_for_ibm_z_systems = 9.2_s390x` - `enterprise_linux_for_power_little_endian = 9.2_ppc64le` - `enterprise_linux_for_x86_64 = 9.2` - `enterprise_linux_server_aus = 9.2` - `codeready_linux_builder_for_arm64_eus = 9.4` - `codeready_linux_builder_for_ibm_z_systems = 9.4_s390x` - `codeready_linux_builder_for_power_little_endian = 9.4_ppc64le` - `codeready_linux_builder_for_x86_64 = 9.4` - `enterprise_linux_for_arm_64 = 9.4` - `enterprise_linux_for_ibm_z_systems = 9.4_s390x` - `enterprise_linux_for_power_little_endian = 9.4_ppc64le` - `enterprise_linux_for_x86_64 = 9.4` - `enterprise_linux_for_x86_64_eus = 9.4` - `enterprise_linux_server_aus = 9.4` - `enterprise_linux_server_for_power_little_endian = 9.4_ppc64le` - `enterprise_linux_server_for_power_little_endian_eus = 9.4_ppc64le` - `codeready_linux_builder_for_arm64_eus = 10.0` - `codeready_linux_builder_for_ibm_z_systems_eus = 10.0_s390x` - `codeready_linux_builder_for_power_little_endian_eus = 10.0_ppc64le` - `codeready_linux_builder_for_x86_64_eus = 10.0` - `enterprise_linux_for_arm_64_eus = 10.0` - `enterprise_linux_for_ibm_z_systems_eus = 10.0_s390x` - `enterprise_linux_for_power_little_endian_eus = 10.0_ppc64le` - `enterprise_linux_for_x86_64_eus = 10.0` - `enterprise_linux_server_for_power_little_endian = 10.0_ppc64le` - `codeready_linux_builder_for_arm64 = 9.6` - `codeready_linux_builder_for_ibm_z_systems = 9.6_s390x` - `codeready_linux_builder_for_power_little_endian = 9.6_ppc64le` - `codeready_linux_builder_for_x86_64 = 9.6` - `enterprise_linux_for_arm_64 = 9.6` - `enterprise_linux_for_ibm_z_systems = 9.6_s390x` - `enterprise_linux_for_power_little_endian = 9.6_ppc64le` - `enterprise_linux_for_power_little_endian_eus = 9.6_ppc64le` - `enterprise_linux_for_x86_64 = 9.6` - `enterprise_linux_for_x86_64_eus = 9.6` - `enterprise_linux_server_aus = 9.6` - `enterprise_linux_server_for_power_little_endian = 9.6_ppc64le` - `enterprise_linux_for_x86_64 = 8.6` - `enterprise_linux_for_x86_64_eus = 8.6` - `enterprise_linux_server_aus = 8.6` - `enterprise_linux_server_for_power_little_endian = 8.6_ppc64le` - `enterprise_linux_server_tus = 8.6` - `enterprise_linux_for_x86_64 = 8.8` - `enterprise_linux_for_x86_64_eus = 8.8` - `enterprise_linux_server_for_power_little_endian = 8.8_ppc64le` - `enterprise_linux_server_tus = 8.8` - `enterprise_linux_for_x86_64_eus = 8.4` - `enterprise_linux_server_aus = 8.4` - `enterprise_linux_server_aus = 8.2` - `ceph_storage = 8.0` - `discovery = 2.0` - `glib < 2.86.3` - `openshift_container_platform = 4.12` - `openshift_container_platform = 4.16` - `openshift_container_platform = 4.17` - `openshift_container_platform = 4.18` - `openshift_container_platform = 4.19` - `openshift_container_platform_for_arm64 = 4.12` - `openshift_container_platform_for_arm64 = 4.16` - `openshift_container_platform_for_arm64 = 4.17` - `openshift_container_platform_for_arm64 = 4.18` - `openshift_container_platform_for_arm64 = 4.19` - `openshift_container_platform_for_ibm_z = 4.12` - `openshift_container_platform_for_ibm_z = 4.16` - `openshift_container_platform_for_ibm_z = 4.17` - `openshift_container_platform_for_ibm_z = 4.18` - `openshift_container_platform_for_ibm_z = 4.19` - `openshift_container_platform_for_linuxone = 4.12` - `openshift_container_platform_for_linuxone = 4.16` - `openshift_container_platform_for_linuxone = 4.17` - `openshift_container_platform_for_linuxone = 4.18` - `openshift_container_platform_for_linuxone = 4.19` - `openshift_container_platform_for_power = 4.12` - `openshift_container_platform_for_power = 4.16` - `openshift_container_platform_for_power = 4.17` ## Remediation Upgrade past the affected range: - `glib 2.86.3`