CVE-2026-6042 Details
Description
A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.
A denial-of-service vulnerability has been identified in musl libc versions 0.8.0 prior to 1.2.6. The issue arises in the GB18030 4-byte decoder within the 'iconv' function of 'src/locale/iconv.c'. The vulnerability is caused by a gap-skipping loop that performs a linear scan of the gb18030126 lookup table, which contains 23,940 entries, on each iteration of an outer loop that is dependent on the input. This results in approximately 500 million comparisons per input character, allowing a local attacker to cause CPU exhaustion by sending a crafted GB18030 payload to any network service that utilizes musl's 'iconv' for character encoding conversion.
Users are advised to update to musl libc versions later than 1.2.6, where this issue has been fixed. The patch is available from the musl libc maintainer.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 10, 2026CISA-ADP
Assessed Apr 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/04/09/19 | CVE | AdvisoryMailing ListRemedyVendor |
| https://vuldb.com/submit/796352 | [email protected] | Technical Description |
| https://vuldb.com/vuln/356620 | [email protected] | AdvisoryRemedy |
| https://vuldb.com/vuln/356620/cti | [email protected] | Content Wall |
| https://www.openwall.com/lists/oss-security/2026/04/02/10 | [email protected] | AdvisoryMailing ListTechnical DescriptionVendor |
| https://www.openwall.com/lists/oss-security/2026/04/03/2 | [email protected] | Mailing ListVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
| CWE-407 | Inefficient Algorithmic Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| musl libc | >= 0.8.0, <= 1.2.6 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | CVE Modified | CVE |
| Apr 10, 2026 | New CVE Received | [email protected] |