A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing… (CVE-2026-107168)

CVE-2026-107168 identifies a flaw in the m17n-lib library where supplying crafted input containing invalid UTF-8 character sequences causes the text parsing function to enter an infinite loop. This leads to sustained high CPU utilization, effectively causing a denial of service condition for applications using the affected library versions. The vulnerability does not impact confidentiality or integrity but affects availability. The affected versions are explicitly enumerated and include multiple 1.6.x, 1.7.x, and 1.8.x builds. No known exploits are reported in the wild, and no patch or remediation information is provided in the source data.

The vulnerability causes a denial of service by making the text parsing function consume excessive CPU resources indefinitely when processing crafted invalid UTF-8 input. This disrupts normal application operation and availability but does not compromise data confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted input containing invalid UTF-8 sequences or implement input validation to reject malformed UTF-8 data before it reaches the vulnerable parsing function.