Glibc and Go security fixes lead toolchain digest

Security patches dominated Languages and Toolchains activity, with glibc addressing two CVEs in libio and intl and Go disclosing a pair of crypto/x509 name-constraint bugs. LLVM discussion centered on contribution policy changes and a proposal to enable ClangIR by default.

Glibc heap overflow in fopen ccs= handling

Multiple patch revisions on libc-alpha fix CVE-2026-18374, a heap buffer overflow in glibc libio when fopen processes the ccs= character-set mode. The series, now at v7 with tests, has moved through review toward merge approval. Anyone shipping or embedding glibc should track the landing, since the overflow sits on a common file-open path that performs charset conversion.

Go x509 email constraints allow subdomain matching

Go reports that crypto/x509 incorrectly applies RFC 5280 rfc822Name constraints, permitting subdomain matches that the standard does not allow. The flaw is tracked as public CVE-2026-78664. Certificate validation that relies on email name constraints may accept names it should reject until a fix ships.

Glibc path traversal via LANGUAGE environment variable

A v4 patch on libc-alpha restricts path traversal when the LANGUAGE environment variable is used, closing BZ 17142 and CVE-2026-84243. The change hardens intl path handling that previously allowed traversal under that variable. Deployments that honor untrusted LANGUAGE values for localization are the main audience for the fix.

Go x509 URI constraints allow subdomain matching

A companion Go issue, CVE-2026-78665, finds that crypto/x509 URI name-constraint matching also allows improper subdomain matches. The bug mirrors the email-constraint mistake in RFC 5280 semantics. Software that enforces URI constraints in certificate chains should watch for the correction.

LLVM contributor policy refresh RFC

An RFC on LLVM Discourse proposes a reviewer tier, mandatory code-owner approvals, and limits on pull requests from non-committers. The thread attracted 23 messages from 19 participants. The changes target review load and clearer ownership as contribution volume grows.

RFC to enable ClangIR build by default

A separate LLVM RFC proposes enabling the ClangIR build, and with it MLIR, by default. The change would add roughly one third to build time and make related CI coverage mandatory. Toolchain and CI maintainers would absorb the longer builds and expanded test surface.