Loading story…
A security advisory disclosed an algorithmic complexity denial-of-service flaw in musl libc's iconv() GB18030 4-byte decoder that can drive extreme CPU consumption with specially crafted input. The bug is caused by a gap-skipping loop that repeatedly performs a linear scan of the 23,940-entry gb18030126 lookup table, allowing a single malicious 4-byte sequence to take about 260 milliseconds to decode instead of roughly 13 microseconds for a benign character, a slowdown of about 19,000x.
The issue affects musl versions 0.8.0 through 1.2.6 and can be exploited remotely against network services that rely on iconv() for character-set conversion; the advisory said a crafted 40 kB payload can take approximately 43 minutes to process. The vulnerability was reported by Jens Jarl Nestén Hansen-Nord and confirmed by musl maintainer Rich Felker, who noted that a patch circulated in the mailing list was only a proposal for testing and not the final fix; a CVE had been requested but was still pending assignment.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The musl libc algorithmic complexity denial-of-service vulnerability in the iconv() GB18030 decoder was assigned CVE-2026-6042. The oss-sec follow-up tied the previously disclosed and fixed issue to the new CVE identifier.
An oss-sec advisory publicly disclosed the musl libc GB18030 decoder denial-of-service issue, including performance impact details such as roughly 260 ms to decode a malicious 4-byte sequence versus about 13 microseconds for a benign one, and about 43 minutes to process a 40 kB crafted payload. The advisory noted the issue could be exploited remotely against network services using musl's iconv() for character encoding conversion.
Musl maintainer Rich Felker confirmed the vulnerability and fixed it, while noting in the mailing list thread that one posted patch was only a proposal for testing and not the final correct fix. A CVE had been requested but was still pending assignment at the time of disclosure.
Jens Jarl Nestén Hansen-Nord reported an algorithmic complexity denial-of-service vulnerability in musl libc's iconv() GB18030 4-byte decoder affecting versions 0.8.0 through 1.2.6. The flaw allows specially crafted input to trigger repeated linear scans of the gb18030126 lookup table, causing extreme CPU consumption.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how `CVE-2024-2961`, a long-standing buffer overflow in glibc's `iconv` implementation for `ISO-2022-CN-EXT`, can be exploited to achieve remote code execution in PHP applications. The technique, dubbed **CNEXT**, builds on earlier work around PHP filter chains and error-based file-read oracles, showing how `php://filter` can be abused not just to read files but to manipulate PHP heap allocations and corrupt internal memory structures. By chaining filters such as `convert.iconv`, `zlib.inflate`, and `dechunk`, the exploit can steer allocator behavior and overwrite `zend_mm_heap` hooks so that PHP ultimately invokes `system()`. The write-up says the method is reliable across PHP `7.0.0` through `8.3.7` and can be delivered in a single GET request, significantly raising the impact of otherwise limited file-read primitives. A demonstrated attack used the WordPress BuddyForms flaw `CVE-2023-26326` to gain file-read access and then escalate to code execution, while the researchers warned that the same path could affect other PHP file-read sinks, including XXE and SQL injection scenarios involving `LOAD DATA LOCAL INFILE`. The findings also revive attention on PHP filter-chain abuse first explored in prior research, showing that seemingly minor disclosure bugs can become full server compromise when combined with glibc and PHP internals.
Jun 29, 2026
A high-severity denial-of-service flaw tracked as **CVE-2026-66731** affects **facil.io** versions `0.7.5` through `0.7.6`, with reporting also indicating exposure in `master`. The bug is in the HTTP/1.1 chunked transfer encoding parser, where a negative hexadecimal chunk size can be accepted and converted into a large positive integer, corrupting parser state and moving a read pointer into unmapped memory. An unauthenticated attacker can trigger the crash remotely with a single crafted `POST` request using `Transfer-Encoding: chunked`, making the issue low-complexity and network exploitable. Advisories say the flaw was introduced when the `0.8.x` HTTP/1.1 parser was backported into `0.7.5`, specifically through `http1_atol16` accepting a leading minus sign. A proof of concept has been noted, and CISA SSVC metadata marks exploitation as automatable with partial technical impact. Researchers also warned that the special case `-0` may not crash the server but could create a request-smuggling primitive in proxy deployments that interpret chunked encoding differently; recommended fixes include rejecting signed chunk sizes in `http1_atol16` or validating that `chunk_len` is non-negative before use.
Jul 28, 2026
CERT Polska disclosed **CVE-2026-16599**, a denial-of-service vulnerability in GNU Wget affecting all versions through **1.25.0**. The flaw is in Wget's FTP **OPIE/S-KEY** authentication handling, where a server-controlled sequence number is used as the iteration count for an MD5 key-derivation loop without an upper-bound check, a weakness mapped to **`CWE-606`**. A malicious FTP server or an on-path attacker can exploit the bug by sending a crafted OPIE challenge with a sequence number near **`INT_MAX`**, causing Wget to perform about **2.1 billion MD5 computations** and hang for an extended period. CERT Polska said the **`--timeout`** option does not prevent the issue because it limits network I/O rather than CPU-bound work, and reported that the vulnerability was fixed in commit **`e9697d98e7249b0f68a6be040a4f3dcc5bc101fa`**.
Aug 25, 2026