CVE-2026-107168

MediumCVSS 6.2/10Last modified Nov 5, 2026

Description

A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to enter an infinite loop. This issue leads to sustained high CPU utilization, resulting in a Denial of Service (DoS) for the affected application.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—

References

Timeline

Published: Oct 7, 2026
Last modified: Nov 5, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1071696.2A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dere CVE-2026-107171.8Out of bounds write and reads in openSeaChest’s --showSCSIDefects in Seagate’s openSeaChest v25.05.3 on all supported platforms allows for w CVE-2026-1071702.9A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under spec CVE-2026-1071716.9An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.CVE-2026-1071746.4A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to abs CVE-2026-1071755.3MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distr CVE-2026-1071766.8A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, an CVE-2026-1071775.9Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt CVE-2026-1071786.8The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printin CVE-2026-107184.6Out of bounds write in openSeaChest’s Trim/Unmap operation in Seagate’s openSeaChest v26.03.0 on all supported platforms allows for writing CVE-2026-1071807.1On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication s CVE-2026-1071818.1Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inje