glibc closes LANGUAGE path traversal in gettext loading

The GNU C Library is patching a directory traversal flaw in gettext’s handling of the LANGUAGE environment variable, filed as bug 17142 and CVE-2026-84243.

In 2014, glibc blocked locale names that contained ".." path components after CVE-2014-0475. That protection never reached the LANGUAGE parsing path used when loading translated message catalogs. Anyone who can set LANGUAGE (for example via SSH AcceptEnv) could push a gettext-using program to open a crafted .mo file from an arbitrary filesystem location.

Avinal Kumar’s fix, suggested by Adhemerval Zanella, applies the path check to every binary rather than only SUID and SGID ones, and also rejects a bare ".." entry that contains no slash and previously slipped through. Florian Weimer asked whether the bare ".." gap had mattered for privileged binaries; Kumar agreed it had never been filtered even there, but judged practical impact limited because a single parent-directory step is seldom writable by an unprivileged attacker.

A regression test now confirms that LANGUAGE values with path separators or ".." are ignored.