[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20260403034323.GO1827@brightrain.aerifal.cx>
Date: Thu, 2 Apr 2026 23:43:30 -0400
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Subject: iconv GB18030 DoS issue
An issue has been reported in musl libc's iconv decoder for GB18030
(Chinese) character encoding, whereby performance for decoding certain
characters is pathologically bad, allowing DoS in processes handling
untrusted data in this encoding or with encoding declared by the
input.
The researcher who found the bug, Jens Jarl Nestén Hansen-Nord, has
applied for a CVE but it has not yet been assigned:
https://www.openwall.com/lists/oss-security/2026/04/02/10
I will follow up with the CVE id once that happens.
The attached patch provides a fix. It can also be obtained from git,
via a checkout or the web-based cgit interface:
https://git.musl-libc.org/cgit/musl/patch/?id=67219f0130ec7c876ac0b299046460fad31caabf
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
