CVE-2026-5435

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.(CVE-2026-5435)

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to validate the RDATA content against the RDATA length in a DNS response when processing LOC, CERT, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.

These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.(CVE-2026-6238)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.(CVE-2026-5435)

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to validate the RDATA content against the RDATA length in a DNS response when processing LOC, CERT, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.

These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.(CVE-2026-6238)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.(CVE-2026-5435)

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to validate the RDATA content against the RDATA length in a DNS response when processing LOC, CERT, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.

These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.(CVE-2026-6238)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.(CVE-2026-5435)

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to validate the RDATA content against the RDATA length in a DNS response when processing LOC, CERT, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.

These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.(CVE-2026-6238)

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928)

• glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)

• glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928)

• glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)

• glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928)

• glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)

• glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-5435 in the glibc package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-5435 in the glibc package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-5435 in the glibc package for Root:Debian:13. Multiple fixed versions available.

Root has patched CVE-2026-5435 in the rootio-glibc package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-5435 in the rootio-glibc package for Root:Ubuntu:24.04. Multiple fixed versions available.

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928)
• glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)
• glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928)
• glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)
• glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928)
• glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)
• glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.

• CVE-2026-5435: out-of-bounds write in ns_sprintrrf() when printing TSIG records; the incomplete ns_t_tsig branch emitted the original id with a bare sprintf() that ignored the caller-supplied buffer length, reachable through the deprecated ns_sprintrr, ns_printrr and fp_nquery entry points [BZ #34033]
• Add the upstream regression test resolv/tst-ns_sprintrr, which the CVE-2026-6238 backport deferred to this fix

Potential buffer overflow in ns_sprintrrf TSIG handling path. (CVE-2026-5435) Buffer overread in ns_printrrf with corrupted RDATA field. (CVE-2026-6238) wordexp with WRDE_APPEND can return or use invalid memory. (CVE-2026-6368) Potential stack-based buffer clash during tilde expansion in wordexp. (CVE-2026-6791) Fix right-justification in strfmon. (CVE-2026-19499) SHIFT_JISX0213 decoding lacks pending character reset. (CVE-2026-77117) EUC_JISX0213 decoding lacks pending character reset. (CVE-2026-80489)

These are all security issues fixed in the glibc-2.43-4.1 package on the GA media of openSUSE Tumbleweed.

This update for glibc fixes the following issues

• CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
• CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure (bsc#1263658).

This update for glibc fixes the following issues

• CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
• CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure (bsc#1263658).

This update for glibc fixes the following issues

• CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
• CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure (bsc#1263658).

This update for glibc fixes the following issues

• CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
• CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure (bsc#1263658).

This update for glibc fixes the following issues:

• CVE-2026-5435: resolv: More types as unknown in ns_sprintrrf (bsc#1263656, BZ #34033)
• resolv: Check for inet_ntop failure in ns_sprintrrf
• CVE-2026-6238: resolv: Fix buffer overreads in ns_sprintrrf (bsc#1263658, BZ #34069)

This update for glibc fixes the following issues

• CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
• CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure (bsc#1263658).

This update for glibc fixes the following issues

• CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
• CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure (bsc#1263658).

It was discovered that the GNU C Library iconv function incorrectly handled certain IBM character sets. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-4046)

It was discovered that the GNU C Library DNS functions incorrectly handled certain DNS server responses when using gethostbyaddr or gethostbyaddr_r. An attacker in a privileged network position could possibly use this issue to cause an application to violate DNS specification or obtain incorrect hostname information. This issue only affected Ubuntu 24.04 LTS. (CVE-2026-4437, CVE-2026-4438)

It was discovered that the GNU C Library deprecated debugging functions incorrectly enforced caller-supplied buffer lengths. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-5435)

It was discovered that the GNU C Library scanf family of functions contained a heap buffer overflow when processing certain format specifiers. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-5450)

It was discovered that the GNU C Library ungetwc function incorrectly handled certain character encodings. An attacker could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-5928)

It was discovered that the GNU C Library deprecated debugging functions incorrectly validated DNS response record data. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-6238)