Glibc closes LANGUAGE path traversal in gettext (CVE-2026-84243)
Attackers who can set LANGUAGE could force gettext programs to load crafted message catalogs from arbitrary paths.
The GNU C Library is fixing a path traversal flaw in gettext handling of the LANGUAGE environment variable, tracked as CVE-2026-84243 and bug 17142.
A 2014 fix for a related locale issue rejected names containing ".." path components, but that protection never covered LANGUAGE processing used to load message catalogs. An attacker who can set LANGUAGE, for example via SSH AcceptEnv, could force any gettext-using program to open a crafted .mo file from an arbitrary filesystem location through directory traversal.
Avinal Kumar's change applies the path checks to all binaries, not only SUID and SGID ones, and rejects bare ".." and "." entries that are not legitimate locale names. LANGUAGE values containing a slash, or equal to ".." or ".", are now refused unconditionally. Adhemerval Zanella suggested the approach. A regression test confirms that path separators and parent-directory references are blocked.