Description
A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| musl | libc | 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | musl | 1.2.5-3.1 | — |
| Debian 13 | musl | 1.2.5-3.1~deb13u1 | — |
| Debian 12 | musl | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | musl | No fix yet | — |
| Ubuntu 26.04 LTS | musl | No fix yet | — |
| Ubuntu 25.10 | musl | No fix yet | — |
| Ubuntu 24.04 LTS | musl | No fix yet | — |
| Ubuntu 22.04 LTS | musl | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | musl | No fix yet | — |
| Ubuntu Pro 18.04 LTS | musl | No fix yet | — |
| Ubuntu Pro 16.04 LTS | musl | No fix yet | — |
| Ubuntu Pro 14.04 LTS | musl | No fix yet | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | musl | 1.2.6-r1 | — |
| Alpine v3.23 | musl | 1.2.5-r22 | — |
| Alpine v3.22 | musl | 1.2.5-r11 | — |
| Alpine v3.21 | musl | 1.2.5-r10 | — |
| Alpine v3.20 | musl | 1.2.5-r2 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | musl | 1.2.4_git20230717-r6 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
jensnesten/CVE-2026-6042-PoC ★ 0 · Apr 14, 2026
Proof of concept and end-to-end test of Algorithmic Complexity DoS in musl libc 0.8.0-1.2.6 assigned CVE-2026-6042
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- VDB-356620 | musl libc GB18030 4-byte Decoder iconv.c iconv algorithmic complexity vdb-entry technical-description
- VDB-356620 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #796352 | musl libc musl 0.8.0 - 1.2.6 Inefficient Algorithmic Complexity third-party-advisory
- https://www.openwall.com/lists/oss-security/2026/04/02/10 related
- https://www.openwall.com/lists/oss-security/2026/04/03/2 patch