CVE-2026-122054: 
Wolfi Análisis y mitigación de vulnerabilidades

CVE-2026-122054 is a Denial of Service vulnerability in the GNU C Library (glibc) caused by an infinite loop in the BIG5-HKSCS character encoding converter. When converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding (e.g., via iconv), the converter fails to make progress, causing the calling application to hang indefinitely. Affected versions are glibc 2.18 through 2.31; versions newer than 2.31 are not affected. The vulnerability was publicly disclosed on November 4, 2026, with a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, oss-security).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). In the BIG5-HKSCS gconv step, four specific double-byte sequences each map to two Unicode code points (e.g., 0x88 0x62 → U+00CA U+0304). The converter emits the first code point and saves the second in its converter state for the next call; however, after emitting the saved second code point, it fails to clear the converter state. Consequently, subsequent calls repeatedly re-emit the saved character without consuming any input, causing any application that retries the conversion to loop forever. Exploitation requires that both the input data and the encoding be attacker-controlled. The vulnerable commit is f22bc486c1ce5e92380a0d06b98fbba639d170e4 (introduced in glibc 2.17.90-786), and the fix was applied in commit c580e6466d6da8262820cdbad19f32c5546226cf targeting glibc 2.32 (oss-security, GitHub Advisory).

Successful exploitation causes the affected application to hang indefinitely, resulting in a complete loss of availability for that process. There is no impact on confidentiality or data integrity. Any network-accessible service that accepts user-supplied text and processes it through glibc's iconv with BIG5-HKSCS encoding is at risk of being rendered unresponsive, potentially requiring a process restart to recover (oss-security, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity, as the attacker must control both the input data and the encoding used by the target application (GitHub Advisory).

1. Identify a target application: Locate a network-accessible service that accepts user-supplied text input and internally processes it using glibc's iconv with BIG5-HKSCS as the source encoding, running on a system with glibc 2.18–2.31.
2. Craft malicious input: Construct input containing one or more of the four specific BIG5-HKSCS double-byte sequences that map to two Unicode code points (e.g., 0x88 0x62), which trigger the converter state bug.
3. Submit the crafted input: Send the malicious BIG-HKSCS-encoded payload to the target application through its normal input channel (e.g., HTTP request body, file upload, form field).
4. Trigger the infinite loop: The glibc iconv converter emits the first code point, saves the second, and on the next call re-emits the saved code point without consuming input. The application retries the conversion indefinitely, causing it to hang.
5. Achieve denial of service: The target process becomes unresponsive and must be manually restarted, denying service to legitimate users (oss-security).

• Process Behavior: Application processes consuming 100% CPU without making progress; processes in an uninterruptible or spinning state associated with character encoding operations.
• Logs: Application logs showing a conversion or encoding operation that never completes; absence of expected log entries after a BIG5-HKSCS input processing event.
• Network: Repeated or sustained connections to a service that becomes unresponsive after receiving input containing specific BIG5-HKSCS byte sequences (e.g., 0x88 0x62).
• System: Elevated load average on systems running glibc 2.18–2.31 with no corresponding increase in useful work; process hang detectable via strace showing repeated iconv-related syscalls without progress (oss-security).

The fix is included in glibc 2.32 and later (fix commit c580e6466d6da8262820cdbad19f32c5546226cf); upgrading to a version newer than 2.31 is the recommended remediation. As a workaround where upgrading is not immediately possible, restrict or validate BIG-HKSCS-encoded input before it reaches iconv processing, and avoid accepting attacker-controlled encoding specifications. Additionally, monitor applications using iconv for unexpected hangs or excessive CPU consumption during character encoding conversions (oss-security, GitHub Advisory).

The vulnerability was disclosed by Carlos O'Donell of the glibc security team via the oss-security mailing list on November 4, 2026, as part of a batch of glibc security advisories (GLIBC-SA-2026-0026). The original issue was reported by Tom Honermann. Community reaction has been limited given the moderate severity and lack of active exploitation; the advisory was noted on infosec.exchange and tracked by standard vulnerability aggregators (oss-security).