CVE-2026-80489: 
Wolfi vulnerability analysis and mitigation

CVE-2026-80489 is a denial-of-service vulnerability in the GNU C Library (glibc) caused by a non-progress infinite loop in the EUC_JISX0213 (also described as SHIFT_JISX0213) to UCS-4 character encoding conversion path. A remote attacker can supply specially crafted text to trigger a continuous processing loop that consumes resources and prevents application progress. The vulnerability was reported on August 27, 2026, and affects glibc across multiple Linux distributions. It carries a CVSS v3.1 base score of 5.9 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop), located in iconvdata/shift_jisx0213.c within glibc. The flaw occurs when a crafted 2-byte input sequence triggers __jisx0213_to_ucs_combining to emit a buffered code point repeatedly without consuming further input, causing persistent retry churn. Exploitation requires three specific preconditions: the attacker must control text fed into an application using the SHIFT_JISX0213-to-UCS-4 conversion, the input must trigger the specific 2-byte expansion path, and the calling application must retry conversion after an E2BIG error when only enough output space remains for the first of two emitted code points. Applications that never use this conversion path or that abort on repeated no-progress E2BIG errors are not practically exposed (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation causes a denial-of-service condition in which the affected application hangs indefinitely, consuming CPU resources without making progress. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Applications performing character set conversion of untrusted text (e.g., web services, text processing pipelines, or email gateways handling Japanese-encoded content) are at risk of complete service disruption (Ubuntu USN-8737-1, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-80489. The CVE status remains "Reserved" and no CISA KEV catalog entry exists. The CVSS attack complexity is rated HIGH, reflecting the specific preconditions required for exploitation. No threat actor attribution or EPSS score data is currently available (Red Hat Advisory, Red Hat Bugzilla).

Patches have been released by multiple Linux distributions. Ubuntu users should update to the following package versions: Ubuntu 26.04 LTS (libc6 2.43-2ubuntu2.4), Ubuntu 24.04 LTS (libc6 2.39-0ubuntu8.9), and Ubuntu 22.04 LTS (libc6 2.35-0ubuntu3.15). Mageia has also issued an advisory (MGASA-2026-0391). As a workaround, applications that abort on repeated no-progress E2BIG errors rather than retrying with the same conversion state are not practically exposed. A standard system update is the recommended remediation (Ubuntu USN-8737-1, Ubuntu USN-8737-2).