What’s Vulnerable › Vulnerabilities

CVE-2026-6042: musl libc GB18030 4-byte Decoder iconv.c iconv algorithmic complexity

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-10 · updated 2026-10-26
• Weakness: CWE-404

Description

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.

Affected products

• musl libc: 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5 (+1)

References

• https://vuldb.com/submit/796352
• https://vuldb.com/vuln/356620
• https://vuldb.com/vuln/356620/cti
• https://www.openwall.com/lists/oss-security/2026/04/02/10
• https://www.openwall.com/lists/oss-security/2026/04/03/2
• http://www.openwall.com/lists/oss-security/2026/04/09/19

Get alerted when CVE-2026-6042 or the next vulnerability affects your stack