Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
glibc text conversion bug can cause service outage
published 2 months ago
Summary
The core library used by Linux systems has a flaw in its handling of certain Japanese character conversions. A specially crafted text string can trap the program in a loop, using up resources and potentially stopping the service from working. Update the library to the latest version to prevent this problem.
What to do
- Update openeuler glibc to version 2.28-131.oe2003sp4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:20.03-LTS-SP4 | openeuler | glibc |
< 2.28-131.oe2003sp4 Fix: upgrade to 2.28-131.oe2003sp4
|
Original advisory text
glibc security update
The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.
Security Fix(es):
CVE-2026-19542 is a vulnerability in the GNU C Library (glibc). Currently, no detailed description is available.(CVE-2026-19542)
A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text.(CVE-2026-77117)
A flaw was found in glibc. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted text to an application that converts text from SHIFT_JISX0213 to UCS-4. The crafted input can lead to a continuous loop of processing, preventing the application from making progress and consuming resources. Exploitation requires specific conditions, including the application retrying conversion after an error with limited output space.(CVE-2026-80489)
Security Fix(es):
CVE-2026-19542 is a vulnerability in the GNU C Library (glibc). Currently, no detailed description is available.(CVE-2026-19542)
A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text.(CVE-2026-77117)
A flaw was found in glibc. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted text to an application that converts text from SHIFT_JISX0213 to UCS-4. The crafted input can lead to a continuous loop of processing, preventing the application from making progress and consuming resources. Exploitation requires specific conditions, including the application retrying conversion after an error with limited output space.(CVE-2026-80489)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-19542 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-77117 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-80489 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published5 Sep 2026
Updated5 Sep 2026
First seen5 Sep 2026
Sources
OESA-2026-3615 · OSV
Track software like this
Free during beta