{"id":"CVE-2026-89092","aliases":["ALSA-2026:95618","AZL-100019","BELL-CVE-2026-89092","DEBIAN-CVE-2026-89092","EUVD-2026-75897","GHSA-gwqp-9qgw-c5pv","MGASA-2026-0581","OESA-2026-4280","OESA-2026-4281","OESA-2026-4282","OESA-2026-4283","RLSA-2026:95618","SUSE-SU-2026:24281-1","SUSE-SU-2026:24326-1","SUSE-SU-2026:4591-1","SUSE-SU-2026:4654-1","SUSE-SU-2026:4656-1","UBUNTU-CVE-2026-89092"],"status":"published","title":"Stack overflow in nscd due to unbounded alloca use","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0024,"percentile":0.15173,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-789"],"published":"2026-09-11T01:23:01Z","modified":"2026-11-09T16:58:23Z","fixes":[{"ecosystem":"Alpaquita:23","package":"glibc","fixed_in":["2.37.0-r30"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"glibc","fixed_in":["2.39.0-r17"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"glibc","fixed_in":["2.43.0-r10"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"glibc","fixed_in":["2.37.0-r30"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"glibc","fixed_in":["2.39.0-r17"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"glibc","fixed_in":["2.43.0-r10"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"glibc","fixed_in":["2.43-7"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"glibc","fixed_in":["2.34-188.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"glibc","fixed_in":["2.38-130.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"glibc","fixed_in":["2.38-130.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"glibc","fixed_in":["2.38-130.oe2403sp4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-all-langpacks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-gconv-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-aa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-af","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-agr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-am","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-an","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-anp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ayc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-az","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-bem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ber","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-bg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-bho","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-bi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-bn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-bo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-br","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-brx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-bs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-byn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-chr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ckb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-cmn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-crh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-cs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-cv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-cy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-da","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-de","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-doi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-dsb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-eo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-es","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-et","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-eu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-fa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-fil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-fo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-fr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-fur","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-fy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-gez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-gl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-gu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-gv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-hak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-he","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-hne","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ht","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-hu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-hy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-id","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-is","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ja","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-kab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-kl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-km","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-kn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ko","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-kok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ku","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-kw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ky","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-lb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-li","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ln","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-lo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-lt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-lv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-lzh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-mag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-mfe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-mg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-mhr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-mi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-mjw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-mk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-mn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-mni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-mr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-mt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-my","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-nan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-nds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ne","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-nhn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-niu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-nl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-nn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-nr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-nso","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-oc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-om","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-or","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-os","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-pa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-pap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-pl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-quz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-rw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-sa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-sah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-sat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-sc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-sd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-se","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-sgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-shn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-sid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-sk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-sl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-sm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-sr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-st","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-sv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-szl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-tg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-th","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-the","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-tig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-tk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-tl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-tn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-to","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-tpi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-tr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-tt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-uk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-unm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ur","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-uz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-ve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-vi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-wa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-wae","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-wal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-wo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-xh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-yi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-yo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-yue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-yuw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-zh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-langpack-zu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-locale-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-minimal-langpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"glibc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libnsl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nscd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.38-21"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0-r0"},{"fixed":"2.37.0-r30"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.39.0-r2"},{"fixed":"2.39.0-r17"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0-r0"},{"fixed":"2.43.0-r10"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0-r0"},{"fixed":"2.37.0-r30"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.39.0-r2"},{"fixed":"2.39.0-r17"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0-r0"},{"fixed":"2.43.0-r10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.36-10~0","2.36-9","2.36-9+deb12u1","2.36-9+deb12u10","2.36-9+deb12u11","2.36-9+deb12u12","2.36-9+deb12u13","2.36-9+deb12u14","2.36-9+deb12u2","2.36-9+deb12u3","2.36-9+deb12u4","2.36-9+deb12u5","2.36-9+deb12u6","2.36-9+deb12u7","2.36-9+deb12u8","2.36-9+deb12u9","2.36-9+loong64","2.37-1","2.37-10","2.37-11","2.37-12","2.37-13","2.37-14","2.37-15","2.37-15.1","2.37-15.1+sh4","2.37-15~deb13u1","2.37-16","2.37-17","2.37-18","2.37-19","2.37-2","2.37-3","2.37-4","2.37-5","2.37-6","2.37-7","2.37-8","2.37-9","2.38-1","2.38-10","2.38-11","2.38-12","2.38-12.1","2.38-13","2.38-14","2.38-15~0","2.38-15~1","2.38-2","2.38-3","2.38-4","2.38-5","2.38-6","2.38-7","2.38-7~0+hurd.1","2.38-8","2.38-9","2.39-1","2.39-2","2.39-3","2.39-3.1","2.39-4","2.39-5","2.39-6","2.39-6+hurd.1","2.39-6+sh4","2.39-7","2.39-7+sh4","2.39-7~0","2.39-8~0","2.40-1","2.40-2","2.40-2+sh4","2.40-3","2.40-3+sh4","2.40-4","2.40-5","2.40-5~hurd.1","2.40-6","2.40-6~1","2.40-7","2.41-1","2.41-10","2.41-11","2.41-12","2.41-13~hurd.0","2.41-13~hurd.1","2.41-2","2.41-3","2.41-4","2.41-4~0","2.41-5","2.41-5~0","2.41-6","2.41-7","2.41-8","2.41-8~0","2.41-8~1","2.41-9","2.41-9~0","2.41-9~1","2.42-1","2.42-10","2.42-11","2.42-12","2.42-12~hurd.1","2.42-13","2.42-14","2.42-14~hurd.1","2.42-15","2.42-15~hurd.1","2.42-16","2.42-17","2.42-2","2.42-3","2.42-4","2.42-5","2.42-6","2.42-7","2.42-8","2.42-8~hurd.1","2.42-8~hurd.2","2.42-9","2.43-1","2.43-2","2.43-3","2.43-3+m68k","2.43-4","2.43-4+m68k","2.43-5","2.43-6","2.43-7","2.43-7~hurd.1","2.44-1","2.44-2","2.44-3"]},{"source":"osv","ecosystem":"Debian:13","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41-12","2.41-12+deb13u1","2.41-12+deb13u2","2.41-12+deb13u3","2.41-12+deb13u4","2.41-13~hurd.0","2.41-13~hurd.1","2.42-1","2.42-10","2.42-11","2.42-12","2.42-12~hurd.1","2.42-13","2.42-14","2.42-14~hurd.1","2.42-15","2.42-15~hurd.1","2.42-16","2.42-17","2.42-2","2.42-3","2.42-4","2.42-5","2.42-6","2.42-7","2.42-8","2.42-8~hurd.1","2.42-8~hurd.2","2.42-9","2.43-1","2.43-2","2.43-3","2.43-3+m68k","2.43-4","2.43-4+m68k","2.43-5","2.43-6","2.43-7","2.43-7~hurd.1","2.44-1","2.44-2","2.44-3"]},{"source":"osv","ecosystem":"Debian:14","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43-7"}]}],"versions":["2.41-12","2.41-13~hurd.0","2.41-13~hurd.1","2.42-1","2.42-10","2.42-11","2.42-12","2.42-12~hurd.1","2.42-13","2.42-14","2.42-14~hurd.1","2.42-15","2.42-15~hurd.1","2.42-16","2.42-17","2.42-2","2.42-3","2.42-4","2.42-5","2.42-6","2.42-7","2.42-8","2.42-8~hurd.1","2.42-8~hurd.2","2.42-9","2.43-1","2.43-2","2.43-3","2.43-3+m68k","2.43-4","2.43-4+m68k","2.43-5","2.43-6","2.43-7~hurd.1"]},{"source":"osv","ecosystem":"Mageia:10","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42-11.mga10"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-188.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-130.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-130.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-130.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.34-284.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-slfo.1.1_11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-159998.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22-114.55.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22-114.55.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-150600.14.61.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-150600.14.61.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-150600.14.61.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-150600.14.61.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6","2.19-0ubuntu6.1","2.19-0ubuntu6.3","2.19-0ubuntu6.4","2.19-0ubuntu6.5","2.19-0ubuntu6.6","2.19-0ubuntu6.7","2.19-0ubuntu6.8","2.19-0ubuntu6.9","2.19-0ubuntu6.10","2.19-0ubuntu6.11","2.19-0ubuntu6.13","2.19-0ubuntu6.14","2.19-0ubuntu6.15","2.19-0ubuntu6.15+esm1","2.19-0ubuntu6.15+esm2","2.19-0ubuntu6.15+esm3","2.19-0ubuntu6.15+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.21-0ubuntu4","2.21-0ubuntu5","2.21-0ubuntu6","2.23-0ubuntu1","2.23-0ubuntu2","2.23-0ubuntu3","2.23-0ubuntu4","2.23-0ubuntu5","2.23-0ubuntu6","2.23-0ubuntu7","2.23-0ubuntu9","2.23-0ubuntu10","2.23-0ubuntu11","2.23-0ubuntu11.2","2.23-0ubuntu11.3","2.23-0ubuntu11.3+esm1","2.23-0ubuntu11.3+esm2","2.23-0ubuntu11.3+esm3","2.23-0ubuntu11.3+esm5","2.23-0ubuntu11.3+esm6","2.23-0ubuntu11.3+esm7","2.23-0ubuntu11.3+esm8","2.23-0ubuntu11.3+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.26-0ubuntu2","2.26-0ubuntu2.1","2.27-0ubuntu2","2.27-0ubuntu3","2.27-3ubuntu1","2.27-3ubuntu1.2","2.27-3ubuntu1.3","2.27-3ubuntu1.4","2.27-3ubuntu1.5","2.27-3ubuntu1.6","2.27-3ubuntu1.6+esm1","2.27-3ubuntu1.6+esm2","2.27-3ubuntu1.6+esm3","2.27-3ubuntu1.6+esm4","2.27-3ubuntu1.6+esm5","2.27-3ubuntu1.6+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.30-0ubuntu2","2.30-0ubuntu3","2.31-0ubuntu5","2.31-0ubuntu6","2.31-0ubuntu7","2.31-0ubuntu9","2.31-0ubuntu9.1","2.31-0ubuntu9.2","2.31-0ubuntu9.3","2.31-0ubuntu9.7","2.31-0ubuntu9.9","2.31-0ubuntu9.12","2.31-0ubuntu9.14","2.31-0ubuntu9.15","2.31-0ubuntu9.16","2.31-0ubuntu9.17","2.31-0ubuntu9.18","2.31-0ubuntu9.18+esm1"]}],"products":[{"vendor":"the gnu c library","product":"glibc"}],"references":[{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=34624","tags":["issue-tracking","report"]},{"url":"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/11/2","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-gwqp-9qgw-c5pv"},{"url":"https://access.redhat.com/errata/RHSA-2026:95618","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8674","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86805","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89092","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-95818","tags":["report"]},{"url":"https://bugzilla.redhat.com/2531725","tags":["report"]},{"url":"https://bugzilla.redhat.com/2536382","tags":["report"]},{"url":"https://bugzilla.redhat.com/2538209","tags":["report"]},{"url":"https://bugzilla.redhat.com/2538306","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-95618.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-89092","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-89092","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0581.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36255","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/27/6","tags":["web"]},{"url":"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/11/2","tags":["web"]},{"url":"https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0016","tags":["web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/17/4","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/22/20","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/30/17","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4280","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4281","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4282","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4283","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:95618","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538209","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538306","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624281-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1281297","tags":["report"]},{"url":"https://bugzilla.suse.com/1282449","tags":["report"]},{"url":"https://bugzilla.suse.com/1282509","tags":["report"]},{"url":"https://bugzilla.suse.com/1283147","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97399","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624326-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264591-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1274723","tags":["report"]},{"url":"https://bugzilla.suse.com/1274726","tags":["report"]},{"url":"https://bugzilla.suse.com/1276946","tags":["report"]},{"url":"https://bugzilla.suse.com/1277262","tags":["report"]},{"url":"https://bugzilla.suse.com/1277921","tags":["report"]},{"url":"https://bugzilla.suse.com/1277922","tags":["report"]},{"url":"https://bugzilla.suse.com/1278011","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80489","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264654-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264656-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-89092","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89092","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-89092","title":"Stack overflow in nscd due to unbounded alloca use","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service.","status":"published","published":"2026-09-11T01:23:01.162Z","modified":"2026-09-11T17:02:18.288Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:19:55.526923Z"}],"euvd":[{"id":"EUVD-2026-75897","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service.","status":"published","published":"2026-09-11T01:23:01Z","modified":"2026-09-11T17:02:18Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T17:28:22.225258Z"}],"ghsa":[{"id":"GHSA-gwqp-9qgw-c5pv","title":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a...","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service.","status":"published","published":"2026-09-11T03:30:22Z","modified":"2026-09-11T06:31:12Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T15:11:43.788148Z"}],"nvd":[{"id":"CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service.","status":"published","published":"2026-09-11T02:18:35.46Z","modified":"2026-10-26T23:10:00.183Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:12:46.271848Z"}],"osv":[{"id":"BELL-CVE-2026-89092","status":"published","published":"2026-09-15T06:05:32.49604Z","modified":"2026-10-01T07:15:04.608960189Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:26.630331Z"},{"id":"DEBIAN-CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a  stack overflow when a malicious DNS server returns too large a response  for a DNS query, resulting in degraded DNS resolution for the system.    Exploitation of this bug needs a system that has nscd enabled and using  an untrusted DNS server for name resolution, with the compromised DNS  server being capable of processing records large enough to result in a  stack overflow in an nscd thread stack.  During experimentation, bind 9  was unable to handle large records, but that could change in future or  with a different name server.  In typical installations, nscd is  executed in an isolated context as its own user without a shell, due to  which any compromise of that service is isolated.    There is a remote possibility of nscd cache corruption if an attacker  manages to get the stack pointer into a desired point in the heap,  potentially resulting in other caches in nscd being overwritten with  corrupt data through the stack overflow, until the buggy code path  eventually results in a crash.    Finally, a crash in nscd may result in performance degradation when  resolving names, but it does not result in a denial of service.","status":"published","published":"2026-09-11T02:18:35.46Z","modified":"2026-10-27T09:47:37.089108403Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"OESA-2026-4280","title":"glibc security update","description":"The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt,  login, exit and more.\r\n\r\nSecurity Fix(es):\n\nThe nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service.(CVE-2026-89092)","status":"published","published":"2026-10-16T11:58:53Z","modified":"2026-10-16T12:15:04.19507178Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4281","title":"glibc security update","description":"The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt,  login, exit and more.\r\n\r\nSecurity Fix(es):\n\nThe nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service.(CVE-2026-89092)","status":"published","published":"2026-10-16T11:58:54Z","modified":"2026-10-16T12:15:08.080597886Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4282","title":"glibc security update","description":"The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt,  login, exit and more.\r\n\r\nSecurity Fix(es):\n\nThe nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service.(CVE-2026-89092)","status":"published","published":"2026-10-16T11:58:55Z","modified":"2026-10-16T12:15:07.172162081Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4283","title":"glibc security update","description":"The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt,  login, exit and more.\r\n\r\nSecurity Fix(es):\n\nThe nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service.(CVE-2026-89092)","status":"published","published":"2026-10-16T11:58:55Z","modified":"2026-10-16T12:15:08.077913988Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RLSA-2026:95618","title":"Moderate: glibc security update","description":"The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.\n\nSecurity Fix(es):\n\n* glibc: nscd stack overflow leads to degraded DNS resolution (CVE-2026-89092)\n\n* glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674)\n\n* glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader (CVE-2026-86805)\n\n* glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. (CVE-2026-95818)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-06T12:04:35.356087Z","modified":"2026-11-06T12:30:03.507771389Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T12:43:06.926783Z"},{"id":"UBUNTU-CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.","status":"published","published":"2026-09-11T02:18:00Z","modified":"2026-11-09T12:52:33.153283817Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-09T13:26:05.568602Z"},{"id":"ALSA-2026:95618","title":"Moderate: glibc security update","description":"The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.  \n\nSecurity Fix(es):  \n\n  * glibc: nscd stack overflow leads to degraded DNS resolution (CVE-2026-89092)\n  * glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674)\n  * glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader (CVE-2026-86805)\n  * glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. (CVE-2026-95818)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-05T00:00:00Z","modified":"2026-11-06T12:00:03.696847811Z","updated_at":"2026-11-06T12:12:56.168821Z"},{"id":"AZL-100019","title":"CVE-2026-89092 affecting package glibc 2.38-21","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service.","status":"published","published":"2026-09-11T02:18:35Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:16.874905Z"},{"id":"MGASA-2026-0581","title":"Updated glibc package fixes security vulnerabilities","description":"Passing an effectively empty string to the `,ccs=` syntax extension of\nthe mode argument in the `fopen` function in the GNU C Library version\n2.45 or earlier may result in a heap buffer overflow when the mode\nstring input to the function is attacker controlled. This usage pattern\nis not seen in applications in common GNU/Linux distributions and\napplications that process user-supplied values for `ccs` should not pass\nthem through without validation. (CVE-2026-18374)\nStack overflow in nscd due to unbounded alloca use. (CVE-2026-89092)\nAssertion failure in the DNS stub resolver with a long search domain.\n(CVE-2026-8674)\nAT_SECURE programs may load attacker-controlled code via $ORIGIN.\n(CVE-2026-86805)\nAT_SECURE program buffer overflow via $ORIGIN processing.\n(CVE-2026-95818)\nDirectory traversal via the LANGUAGE environment variable.\n(CVE-2026-84243)\n","status":"published","published":"2026-11-09T16:32:57Z","modified":"2026-11-09T16:58:23.946376546Z","updated_at":"2026-11-09T17:04:22.742827Z"},{"id":"SUSE-SU-2026:24281-1","title":"Security update for glibc","description":"This update for glibc fixes the following issues:\n\n- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to\n  trigger a process crash (bsc#1281297).\n- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges\n  (bsc#1282509).\n- CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).\n- CVE-2026-97399: one byte out-of-bounds read via function `strncasecmp` on Power8 can lead to a program crash\n  (bsc#1283147).\n","status":"published","published":"2026-10-19T10:26:04Z","modified":"2026-10-27T17:23:10.508907557Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24326-1","title":"Security update for glibc","description":"This update for glibc fixes the following issues:\n\n- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to\n  trigger a process crash (bsc#1281297).\n- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges\n  (bsc#1282509).\n- CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).\n- CVE-2026-97399: one byte out-of-bounds read via function `strncasecmp` on Power8 can lead to a program crash\n  (bsc#1283147).\n","status":"published","published":"2026-10-19T08:37:31Z","modified":"2026-10-27T17:23:14.122169891Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4591-1","title":"Security update for glibc","description":"This update for glibc fixes the following issues:\n\n- CVE-2026-6368: wordexp WRDE_APPEND rollback restores stale we_wordv, leading to invalid free in wordfree\n  (bsc#1274726).\n- CVE-2026-6791: wordexp: unbounded alloca (strndupa) in parse_tilde (bsc#1274723).\n- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to\n  trigger a process crash (bsc#1281297).\n- CVE-2026-18374: overflow in the fopen ccs extension (bsc#1277262).\n- CVE-2026-19542: Fix out-of-bounds array write in tdelete (bsc#1276946).\n- CVE-2026-77117: non-progress DoS in SHIFT_JISX0213 -\u0026gt; UCS-4 conversion state handling (bsc#1277921).\n- CVE-2026-80489: non-progress DoS in SHIFT_JISX0213 -\u0026gt; UCS-4 conversion state handling (bsc#1277922).\n- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges\n  (bsc#1282509).\n- CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).\n- CVE-2026-97399: one byte out-of-bounds read via function `strncasecmp` on Power8 can lead to a program crash\n  (bsc#1283147).\n","status":"published","published":"2026-10-08T12:18:31Z","modified":"2026-10-09T18:15:03.742602908Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4654-1","title":"Security update for glibc","description":"This update for glibc fixes the following issues:\n\n- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges\n  (bsc#1282509).\n- CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).\n","status":"published","published":"2026-10-13T16:56:02Z","modified":"2026-10-14T17:30:07.619432041Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4656-1","title":"Security update for glibc","description":"This update for glibc fixes the following issues:\n\n- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to\n  trigger a process crash (bsc#1281297).\n- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges\n  (bsc#1282509).\n- CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).\n- CVE-2026-97399: one byte out-of-bounds read via function `strncasecmp` on Power8 can lead to a program crash\n  (bsc#1283147).\n","status":"published","published":"2026-10-14T07:48:58Z","modified":"2026-10-14T17:30:08.71945699Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}