The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42733 advisory.

    - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-181724)
    - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-181725)
    - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172700)
    - Add tests for CVE-2026-4437 and CVE-2026-4438 (RHEL-173358)
    - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules       (RHEL-162891)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0772 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-5435:
    The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer     fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing     TSIG records.

    CVE-2026-5928:
    Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has     overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or     earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in     unintentional disclosure of neighboring data in the heap, or a program crash.

    A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes     ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream     read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr     is not initialized and hence points to NULL. The buffer under-read requires a special situation where the     input character encoding is such that there are overlaps between single byte representations and multibyte     representations in that encoding, resulting in spurious matches. The spurious match case is not possible     in the standard Unicode character sets.

    CVE-2026-6238:
    The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer     fail to validate the RDATA content against the RDATA length in a DNS response when processing LOC, CERT,     TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to     crash or read uninitialized memory.

    These functions are for application debugging only and hence not in the path of code executed by the DNS     resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new     applications.  Applications should consider porting away from these interfaces since they may be removed     in future versions.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:42952 advisory.

    * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide     character encodings (CVE-2026-5928)
      * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)
      * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:42952 advisory.

    * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide     character encodings (CVE-2026-5928)

    * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)

    * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42952 advisory.

    - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336,       RHEL-185614)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:42694 advisory.

    * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide     character encodings (CVE-2026-5928)

    * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)

    * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:42733 advisory.

    * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide     character encodings (CVE-2026-5928)
      * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)
      * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:42694 advisory.

    * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide     character encodings (CVE-2026-5928)
      * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)
      * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42952 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide     character encodings (CVE-2026-5928)

    * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)

    * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:42733 advisory.

    * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide     character encodings (CVE-2026-5928)

    * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)

    * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42694 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide     character encodings (CVE-2026-5928)

    * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)

    * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42733 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide     character encodings (CVE-2026-5928)

    * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)

    * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3030-1 advisory.

    This update for glibc fixes the following issues

    - CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write     (bsc#1263656).
    - CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized     memory disclosure       (bsc#1263658).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3029-1 advisory.

    This update for glibc fixes the following issues

    - CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write     (bsc#1263656).
    - CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized     memory disclosure       (bsc#1263658).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2987-1 advisory.

    - CVE-2026-5435: resolv: More types as unknown in ns_sprintrrf (bsc#1263656, BZ #34033)
    - resolv: Check for inet_ntop failure in ns_sprintrrf
    - CVE-2026-6238: resolv: Fix buffer overreads in ns_sprintrrf (bsc#1263658, BZ #34069)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21228-1 advisory.

    This update for glibc fixes the following issues

    - CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write     (bsc#1263656).
    - CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized     memory disclosure       (bsc#1263658).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4b7780802c advisory.

    This update provides various security fixes.

    * Buffer overflow in `scanf` `%mc` (CVE-2026-5450)
    * `ns_sprintrrf` buffer overreads (CVE-2026-6238)
    * `ns_sprintrrf` buffer overflow in TSIG record processing (CVE-2026-5435)
    * Memory corruption in `ungetwc` (CVE-2026-5928)
    * Assertion failure in `iconv` with IBM1390, IBM1399 charsets (CVE-2026-4046)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ced72ab158 advisory.

    This update provides various security fixes.

    * Buffer overflow in `scanf` `%mc` (CVE-2026-5450)
    * `ns_sprintrrf` buffer overreads (CVE-2026-6238)
    * `ns_sprintrrf` buffer overflow in TSIG record processing (CVE-2026-5435)
    * Memory corruption in `ungetwc` (CVE-2026-5928)
    * Assertion failure in `iconv` with IBM1390, IBM1399 charsets (CVE-2026-4046)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer     fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing     TSIG records. (CVE-2026-5435)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
330358	Oracle Linux 8 : glibc (ELSA-2026-42733)	Nessus	Oracle Linux Local Security Checks	high
330261	TencentOS Server 3: glibc (TSSA-2026:0772)	Nessus	Tencent Local Security Checks	high
505764	Siemens SIMATIC S7-1500 CPU 1518 MFP Out-of-bounds Write (CVE-2026-5435)	Tenable OT Security	Tenable.ot	high
329229	AlmaLinux 9 : glibc (ALSA-2026:42952)	Nessus	Alma Linux Local Security Checks	high
329189	RockyLinux 9 : glibc (RLSA-2026:42952)	Nessus	Rocky Linux Local Security Checks	high
329130	Oracle Linux 9 : glibc (ELSA-2026-42952)	Nessus	Oracle Linux Local Security Checks	high
329056	RockyLinux 10 : glibc (RLSA-2026:42694)	Nessus	Rocky Linux Local Security Checks	high
328983	AlmaLinux 8 : glibc (ALSA-2026:42733)	Nessus	Alma Linux Local Security Checks	high
328972	AlmaLinux 10 : glibc (ALSA-2026:42694)	Nessus	Alma Linux Local Security Checks	high
328945	RHEL 9 : glibc (RHSA-2026:42952)	Nessus	Red Hat Local Security Checks	high
328882	RockyLinux 8 : glibc (RLSA-2026:42733)	Nessus	Rocky Linux Local Security Checks	high
328805	RHEL 10 : glibc (RHSA-2026:42694)	Nessus	Red Hat Local Security Checks	high
328804	RHEL 8 : glibc (RHSA-2026:42733)	Nessus	Red Hat Local Security Checks	high
327331	SUSE SLED15: glibc / glibc-32bit / glibc-devel / glibc-devel-32bit / etc (SUSE-SU-2026:3030-1)	Nessus	SuSE Local Security Checks	high
327302	SUSE SLES15: glibc / glibc-32bit / glibc-devel / glibc-devel-32bit / etc (SUSE-SU-2026:3029-1)	Nessus	SuSE Local Security Checks	high
326935	SUSE SLES12: glibc / glibc-32bit / glibc-devel / glibc-devel-32bit / etc (SUSE-SU-2026:2987-1)	Nessus	SuSE Local Security Checks	high
325114	openSUSE 16: cross-aarch64-glibc-devel / cross-ppc64le-glibc-devel / etc (openSUSE-SU-2026:21228-1)	Nessus	SuSE Local Security Checks	high
312242	Fedora 43 : glibc (2026-4b7780802c)	Nessus	Fedora Local Security Checks	critical
311773	Fedora 44 : glibc (2026-ced72ab158)	Nessus	Fedora Local Security Checks	critical
310836	Linux Distros Unpatched Vulnerability : CVE-2026-5435	Nessus	Misc.	high

Detections

Analytics

CVE-2026-5435

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

critical

high