CVE-2026-4046.toml

# glibc iconv() denial of service on specific character sets.
# 5-Spot never converts between character encodings: no iconv_open, iconv,
# or locale-dependent conversion is invoked directly, and no dependency in
# Cargo.lock links against libiconv. All string data handled by the
# controller is UTF-8 produced by serde_json / serde_yaml / TOML, which do
# not route through glibc's iconv.
cve = "CVE-2026-4046"
status = "not_affected"
justification = "vulnerable_code_not_in_execute_path"
impact_statement = "5-Spot performs no character-set conversions; the glibc iconv() path exercised by this CVE is unreachable from the controller binary."
products = ["pkg:oci/5-spot"]
author = "erick.bourgeois@gmail.com"
timestamp = "2026-04-19T00:00:00Z"