Red Hat Security Advisory

RHSA-2026:84753

glibc security update

Released 2026-10-19 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) glibc-devel-2.39-145.el10_2, glibc-doc-2.39-145.el10_2, glibc-locale-source-2.39-145.el10_2 +1
Red Hat Enterprise Linux BaseOS (v. 10) glibc-2.39-145.el10_2, glibc-all-langpacks-2.39-145.el10_2, glibc-common-2.39-145.el10_2 +47
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) glibc-benchtests-2.39-145.el10_2, glibc-nss-devel-2.39-145.el10_2, glibc-static-2.39-145.el10_2 +2

Fixes 4 records

TI-2026-55525 CVE-2026-80489 · GHSA-w45w-pf39-v4pp

EUC_JISX0213 decoding may hang on crafted input

LOW 26

Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00358 Published 2026-09-15 Partial fix CWE-835

TI-2026-53861 CVE-2026-77117 · GHSA-g8c6-x9r9-wj7f

SHIFT_JISX0213 decoding may hang on crafted input

LOW 26

Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calli…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00358 Published 2026-09-15 Partial fix CWE-835

TI-2026-07623 CVE-2026-8674 · GHSA-qghr-qhfc-4hxp

Assertion failure in the DNS stub resolver with a long search domain

LOW 24

Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 res…

CVSS 3.1MEDIUM 5.3 Adjacent network No auth No interaction EPSS 0.00315 Published 2026-09-17 Partial fix CWE-617

TI-2026-15108 CVE-2026-18374 · GHSA-qg52-8pr2-xj9v

Out-of-bounds write in GNU glibc

LOW 21

Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string inpu…

CVSS 3.1MEDIUM 4.9 Local No auth No interaction EPSS 0.00144 Published 2026-08-27 Partial fix · 2.45 CWE-787