Executive brief
A security flaw in the musl standard C library can allow an attacker to crash or slow down applications to the point of being unusable. The library is a fundamental component used by many Linux-based systems to handle basic tasks like text conversion. By providing specially crafted text data, an attacker can force the system to consume excessive processor power, leading to a denial of service.
Technical details
The GB18030 4-byte decoder in musl libc's iconv() implementation contains a gap-skipping loop that performs a full linear scan of a large lookup table on each iteration of an input-dependent outer loop. For specific 4-byte sequences, this results in approximately 500 million comparisons per input character, causing extreme CPU exhaustion. While the NVD entry suggests a local attack vector, the original advisory notes that remote attackers can exploit this by sending crafted payloads to any network service that utilizes musl's iconv() for character encoding conversion. A 40kB payload can reportedly take approximately 43 minutes to decode. The issue is fixed in versions following 1.2.6 via a patch that replaces the linear scan with a more efficient lookup mechanism.
Affected products
- musl-libc.org musl libc 0.8.0 to 1.2.6
Timeline
- 2026-04-02: disclosed: Initial disclosure on oss-security mailing list
- 2026-04-02: patched: Maintainer confirmed fix and provided patch
- 2026-04-09: advisory: CVE-2026-6042 assigned
- 2026-04-10: other: NVD publication date