CVE-2026-80489 - Vulnerability Details - OpenCVE

A flaw was found in glibc. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted text to an application that converts text from SHIFT_JISX0213 to UCS-4. The crafted input can lead to a continuous loop of processing, preventing the application from making progress and consuming resources. Exploitation requires specific conditions, including the application retrying conversion after an error with limited output space.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Gnu	Glibc

No data.

No data.

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-80489
https://www.cve.org/CVERecord?id=CVE-2026-80489

History

Mon, 31 Aug 2026 21:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Gnu Gnu glibc
Vendors & Products		Gnu Gnu glibc

Thu, 27 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Description		A flaw was found in glibc. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted text to an application that converts text from SHIFT_JISX0213 to UCS-4. The crafted input can lead to a continuous loop of processing, preventing the application from making progress and consuming resources. Exploitation requires specific conditions, including the application retrying conversion after an error with limited output space.
Title		glibc: Non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state
Weaknesses		CWE-835
References		https://nvd.nist.gov/vuln/detail/CVE-2026-80489 https://www.cve.org/CVERecord?id=CVE-2026-80489
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

MITRE

No data.

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-08-27T08:49:17Z

Links: CVE-2026-80489 - Bugzilla

{"acknowledgement": "This issue was discovered by Found by AISLE in partnership with Red Hat (Aisle Research).", "bugzilla": {"description": "glibc: Non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state", "id": "2524870", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524870"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["A flaw was found in glibc. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted text to an application that converts text from SHIFT_JISX0213 to UCS-4. The crafted input can lead to a continuous loop of processing, preventing the application from making progress and consuming resources. Exploitation requires specific conditions, including the application retrying conversion after an error with limited output space."], "name": "CVE-2026-80489", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "glibc", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "compat-glibc", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "glibc", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "compat-glibc", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "glibc", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "glibc", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "glibc", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "glibc", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Under investigation", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Under investigation", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-27T08:49:17Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80489\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80489"], "statement": "This Moderate flaw in glibc's SHIFT_JISX0213 to UCS-4 conversion state handling can lead to a denial of service. Exploitation requires an application to convert untrusted text using this specific conversion path, handle a particular 2-byte sequence, and repeatedly retry after an E2BIG error with limited output space. Applications not meeting these specific conditions are not practically exposed.", "threat_severity": "Moderate"}