medium 5.9

CVE-2026-77117 json

SHIFT_JISX0213 decoding may hang on crafted input

published 2026-09-15 55 d ago modified 2026-09-18 51 d ago also EUVD-2026-78409

cvss: 5.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 29%
public exploits: 0; none known

Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.

Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.

Patch / fix

distros 7

debian ubuntu red hat suse opensuse almalinux rocky linux

glibc Debian 14 2.43-5

debian advisories DEBIAN-CVE-2026-77117

glibc Ubuntu 22.04 LTS 2.35-0ubuntu3.15
glibc Ubuntu 24.04 LTS 2.39-0ubuntu8.9
glibc Ubuntu 26.04 LTS 2.43-2ubuntu2.4

ubuntu advisories UBUNTU-CVE-2026-77117

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

glibc RHEL 10.2 2.39-145.el10_2
libnsl RHEL 10.2 2.39-145.el10_2
nss_db RHEL 10.2 2.39-145.el10_2
nss_hesiod RHEL 10.2 2.39-145.el10_2
glibc-utils RHEL 10.2 2.39-145.el10_2
glibc-common RHEL 10.2 2.39-145.el10_2
glibc-benchtests RHEL 10.2 2.39-145.el10_2
glibc-gconv-extra RHEL 10.2 2.39-145.el10_2

red hat advisories RHSA-2026:84753 RHSA-2026:80798 RHSA-2026:79281 RHSA-2026:61737

glibc SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +8 more 2.31-150300.109.1
glibc SLES 16.0, Linux Micro Extras 6.2, Linux Micro 6.2 +1 more 2.40-160000.7.1
glibc SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Development Tools 15 SP7 +1 more 2.38-150600.14.58.1
glibc Linux Micro 6.1 2.38-slfo.1.1_10.1
glibc Linux Micro 6.0 2.38-15.1
glibc SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 2.22-114.52.2

suse advisories SUSE-SU-2026:4591-1 SUSE-SU-2026:23934-1 SUSE-SU-2026:23957-1 SUSE-SU-2026:23929-1 SUSE-SU-2026:4250-1 SUSE-SU-2026:4204-1

glibc openSUSE Leap 16.0 2.40-160000.7.1
glibc-cross-s390x-src openSUSE Leap 16.0 2.40-160000.7.1
glibc-cross-aarch64-src openSUSE Leap 16.0 2.40-160000.7.1
glibc-cross-ppc64le-src openSUSE Leap 16.0 2.40-160000.7.1
glibc-cross-riscv64-src openSUSE Leap 16.0 2.40-160000.7.1
glibc openSUSE Tumbleweed 2.44-2.1

opensuse advisories openSUSE-SU-2026:21968-1 openSUSE-SU-2026:11787-1

glibc AlmaLinux 10 2.39-145.el10_2.alma.1
libnsl AlmaLinux 10 2.39-145.el10_2.alma.1
nss_db AlmaLinux 10 2.39-145.el10_2.alma.1
nss_hesiod AlmaLinux 10 2.39-145.el10_2.alma.1
glibc-utils AlmaLinux 10 2.39-145.el10_2.alma.1
glibc-common AlmaLinux 10 2.39-145.el10_2.alma.1
glibc-benchtests AlmaLinux 10 2.39-145.el10_2.alma.1
glibc-gconv-extra AlmaLinux 10 2.39-145.el10_2.alma.1

almalinux advisories ALSA-2026:84753 ALSA-2026:80798 ALSA-2026:79281

glibc Rocky Linux 10 2.39-145.el10_2
glibc Rocky Linux 8 2.28-251.el8_10.48
glibc Rocky Linux 9 2.34-283.el9_8

rocky linux advisories RLSA-2026:84753 RLSA-2026:80798 RLSA-2026:79281

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-77117 updated 2026-11-06 cvss 5.9

glibc: Non-progress DoS in SHIFT_JISX0213 -&gt

Red Hat Enterprise Linux 6 nscd, glibc, glibc-utils, compat-glibc, glibc-common Red Hat Enterprise Linux 7 nscd, glibc, glibc-utils, compat-glibc, glibc-common Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
affected: workaround, no fix available “Fix deferred”
Red Hat Cost Management 4 costmanagement/costmanagement-metrics-rhel9-operator 1793202662
fixed: vendor fix RHSA-2026:95264
Red Hat Cost Management On-Premise 1 costmanagement/costmanagement-ui-rhel10 1792605272
fixed: vendor fix RHSA-2026:87400
Red Hat Enterprise Linux AppStream (v. 8) glibc-utils 2.28-251.el8_10.48, compat-libpthread-nonshared 2.28-251.el8_10.48
fixed: vendor fix RHSA-2026:80798
Red Hat Enterprise Linux AppStream (v. 9) glibc-utils 2.34-283.el9_8, glibc-locale-source 2.34-283.el9_8
fixed: vendor fix RHSA-2026:79281
Red Hat Enterprise Linux AppStream (v. 10) glibc-utils 2.39-145.el10_2, glibc-locale-source 2.39-145.el10_2
fixed: vendor fix RHSA-2026:84753
Red Hat Enterprise Linux BaseOS (v. 8) nscd 2.28-251.el8_10.48, glibc 2.28-251.el8_10.48, libnsl 2.28-251.el8_10.48, nss_db 2.28-251.el8_10.48, glibc-common 2.28-251.el8_10.48, glibc-gconv-extra 2.28-251.el8_10.48, +3 more
fixed: vendor fix RHSA-2026:80798
Red Hat Enterprise Linux BaseOS (v. 9) nscd 2.34-283.el9_8, glibc 2.34-283.el9_8, libnsl 2.34-283.el9_8, glibc-common 2.34-283.el9_8, glibc-gconv-extra 2.34-283.el9_8, glibc-all-langpacks 2.34-283.el9_8, +1 more
fixed: vendor fix RHSA-2026:79281

show 7 more

Red Hat Enterprise Linux BaseOS (v. 10) glibc 2.39-145.el10_2, libnsl 2.39-145.el10_2, glibc-common 2.39-145.el10_2, glibc-gconv-extra 2.39-145.el10_2, glibc-all-langpacks 2.39-145.el10_2, glibc-minimal-langpack 2.39-145.el10_2
fixed: vendor fix RHSA-2026:84753
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) nss_db 2.34-283.el9_8, nss_hesiod 2.34-283.el9_8, glibc-benchtests 2.34-283.el9_8
fixed: vendor fix RHSA-2026:79281
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) nss_db 2.39-145.el10_2, nss_hesiod 2.39-145.el10_2, glibc-benchtests 2.39-145.el10_2
fixed: vendor fix RHSA-2026:84753
Red Hat Enterprise Linux CRB (v. 8) nss_hesiod 2.28-251.el8_10.48, glibc-benchtests 2.28-251.el8_10.48
fixed: vendor fix RHSA-2026:80798
Red Hat Hardened Images glibc 2.43-8.4.hum1, libnsl 2.43-8.4.hum1, nss_db 2.43-8.4.hum1, glibc32 2.43-8.4.hum1, nss_hesiod 2.43-8.4.hum1, glibc-utils 2.43-8.4.hum1, +9 more
fixed: vendor fix RHSA-2026:61737
Red Hat Update Infrastructure 5 rhui5/cds-rhel9 1791978528, rhui5/rhua-rhel9 1791978693, rhui5/haproxy-rhel9 1791978528, rhui5/installer-rhel9 1791964013, rhui5/cds-kubernetes-rhel9 1791978534
fixed: vendor fix RHSA-2026:82939
Red Hat Cost Management 4 costmanagement/costmanagement-metrics-operator-bundle 1793205914 Red Hat OpenShift AI (RHOAI) rhoai/odh-kserve-controller-rhel9, rhoai/odh-model-serving-api-rhel9, rhoai/odh-workbenches-operator-rhel9, rhoai/odh-llama-stack-k8s-operator-rhel9, rhoai/odh-kserve-llmisvc-controller-rhel9
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 55 d ago (2026-09-15)

Exploit prediction

0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

The GNU C Library glibc

Classification

Weakness

CWE-835 Loop with Unreachable Exit Condition

References

sourceware.org /git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019
vendor-advisory
sourceware.org /bugzilla/show_bug.cgi?id=34556
issue-tracking

Sources

CVE List CVE-2026-77117
NVD CVE-2026-77117

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary