Description
An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.
Published: 2026-08-28
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Update relibc
AI Analysis

Impact

An issue in the with_argv function of the relibc library allows an attacker to cause a denial of service by supplying specially crafted arguments. The vulnerability arises because the function performs insufficient input validation and permits resource exhaustion, as identified by CWE-400 Resource Exhaustion weaknesses. When an application passes malformed arguments to with_argv, the function can either crash or consume excessive resources, leading to a loss of availability for the affected process.

Affected Systems

The flaw is present in the relibc component of the Redox operating system, specifically in commit 61f42d. Vendor or product identifiers were not supplied in the CVE payload, so no specific vendor or distribution is named; any instance of Redox or other operating systems that include the affected commit without the subsequent fix may be vulnerable.

Risk and Exploitability

The CVSS score is 7.5, indicating high severity, while the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that the attack vector requires an attacker to supply crafted command‑line arguments to a program that uses relibc’s with_argv. No publicly known exploits are documented, and the lack of an EPSS score suggests a lower likelihood of exploitation. However, if an attacker can supply the input, the impact remains a critical loss of availability.

Generated by OpenCVE AI on August 29, 2026 at 02:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the patch from merge request #989 or any later version of relibc that incorporates the fix.
  • If a patched version is not immediately available, review the changes in merge request #989 and apply them manually to correct the input validation flaw before use.
  • As a temporary measure, validate or limit the number of arguments supplied to with_argv to protect against resource exhaustion and input‑validation failures.

Generated by OpenCVE AI on August 29, 2026 at 02:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 29 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
Title Denial of Service via Crafted Arguments in relibc's with_argv Function

Sat, 29 Aug 2026 01:30:00 +0000

Type Values Removed Values Added
Title Denial of Service via Crafted Input in relibc's with_argv Function
Weaknesses CWE-20

Fri, 28 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Fri, 28 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Title Denial of Service via Crafted Input in relibc's with_argv Function
Weaknesses CWE-20

Fri, 28 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Redox-os
Redox-os relibc
Vendors & Products Redox-os
Redox-os relibc

Fri, 28 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Description An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.
References

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-28T20:13:44.478Z

Reserved: 2026-04-06T00:00:00.000Z

Link: CVE-2026-38638

cve-icon Vulnrichment

Updated: 2026-08-28T20:13:36.451Z

cve-icon NVD

Status : Deferred

Published: 2026-08-28T16:17:47.063

Modified: 2026-09-09T16:04:24.933

Link: CVE-2026-38638

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-29T02:30:17Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption