Bug 2514553

Summary: CVE-2026-6791 zig: Glibc: Denial of Service via stack exhaustion during tilde expansion [fedora-all]
Product: [Fedora] Fedora Reporter: Marian Rehak <mrehak>
Component: zigAssignee: Jan Drögehoff <sentrycraft123>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: alebastr89, baltevl, josherna, marko03kostic, purin21345, renich, sentrycraft123, suraj.ghimire7
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["3f17fc3a-0d1d-4d18-83dc-e0555f1b08e3"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-09-05 11:04:03 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2513603    

Description Marian Rehak 2026-08-12 10:46:41 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.
Comment 1 Renich Bon Ciric 2026-09-05 11:04:03 UTC 
Zig is not affected by this vulnerability.

While `zig.spec` declares `Provides: bundled(glibc) = 2.43` to account for embedded headers and ABI symbol metadata, Zig does not bundle or compile the GNU C Library implementation of the affected routine.

Specifically:
- Zig only ships glibc ABI symbol tables (`abilists`) to generate compile-time dynamic linking stubs (`.so`), generic headers, and minimal C runtime startup objects (`crt1.o`, `elf-init`, `stat` shims).
- Zig compiler binaries and generated executables dynamically link against the host/target system's runtime `libc.so.6`.

Closing as NOTABUG.