Executive Summary

CVE-2026-6042 is a performance vulnerability in musl libc's iconv() function, specifically in the GB18030 4-byte decoder. The decoder contains a gap-skipping loop that performs a full linear scan of a large lookup table with 23,940 entries on each iteration of an outer loop. For certain crafted 4-byte sequences, this outer loop executes about 20,905 times, resulting in roughly 500 million comparisons per input character.

This inefficient algorithmic complexity causes a severe slowdown when decoding these crafted sequences, leading to excessive CPU usage and a denial-of-service condition. For example, decoding a single crafted 4-byte input character can take approximately 260 milliseconds compared to about 13 microseconds for a normal character, a slowdown factor of 19,000 times.

The vulnerability affects musl libc versions from 0.8.0 up to 1.2.6 and was fixed by replacing the inefficient linear scan with a more efficient lookup using a smaller auxiliary table, eliminating the costly nested loops.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited by an attacker to cause a denial of service (DoS) through CPU exhaustion. By sending a specially crafted GB18030 encoded payload to any network service that uses musl libc's iconv() for character encoding conversion, the attacker can trigger the inefficient decoding process.

The excessive CPU usage caused by decoding these crafted sequences can significantly degrade system performance or make the service unresponsive, potentially leading to downtime or disruption of service availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability manifests as a significant performance degradation when musl libc's iconv() function decodes certain crafted GB18030 4-byte sequences, causing excessive CPU usage.

Detection can be performed by monitoring CPU usage spikes on services that use musl libc's iconv() for character encoding conversion, especially when processing GB18030 encoded data.

A practical test involves decoding a crafted GB18030 4-byte input character (for example, bytes 0x82 0x35 0x8F 0x33) using the affected musl libc version and measuring the time taken. A slowdown factor of about 19,000x compared to benign input indicates the vulnerability.

While no explicit commands are provided in the resources, you can use tools like strace or perf to monitor CPU usage of processes using iconv, or write a small test program that uses iconv() to decode the crafted input and measure execution time.

Useful 0 Not Useful 0

Mitigation Strategies

The recommended immediate mitigation is to deploy the patch provided by the musl libc maintainer that fixes the inefficient algorithm in the GB18030 4-byte decoder.

This patch replaces the costly nested loops scanning the large gb18030126 lookup table with a more efficient loop over a smaller auxiliary array, eliminating the performance bottleneck.

Until the patch can be applied, consider limiting or filtering GB18030 encoded input to services using musl libc's iconv() to reduce the risk of denial-of-service via crafted payloads.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0