The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21228-1 advisory.

    This update for glibc fixes the following issues

    - CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write     (bsc#1263656).
    - CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized     memory disclosure       (bsc#1263658).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4b7780802c advisory.

    This update provides various security fixes.

    * Buffer overflow in `scanf` `%mc` (CVE-2026-5450)
    * `ns_sprintrrf` buffer overreads (CVE-2026-6238)
    * `ns_sprintrrf` buffer overflow in TSIG record processing (CVE-2026-5435)
    * Memory corruption in `ungetwc` (CVE-2026-5928)
    * Assertion failure in `iconv` with IBM1390, IBM1399 charsets (CVE-2026-4046)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ced72ab158 advisory.

    This update provides various security fixes.

    * Buffer overflow in `scanf` `%mc` (CVE-2026-5450)
    * `ns_sprintrrf` buffer overreads (CVE-2026-6238)
    * `ns_sprintrrf` buffer overflow in TSIG record processing (CVE-2026-5435)
    * Memory corruption in `ungetwc` (CVE-2026-5928)
    * Assertion failure in `iconv` with IBM1390, IBM1399 charsets (CVE-2026-4046)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to     version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing     A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target     application to crash or read uninitialized memory. These functions are for application debugging only and     hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since     version 2.34 and should not be used by any new applications. Applications should consider porting away     from these interfaces since they may be removed in future versions. (CVE-2026-6238)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
325114	openSUSE 16: cross-aarch64-glibc-devel / cross-ppc64le-glibc-devel / etc (openSUSE-SU-2026:21228-1)	Nessus	SuSE Local Security Checks	high
312242	Fedora 43 : glibc (2026-4b7780802c)	Nessus	Fedora Local Security Checks	critical
311773	Fedora 44 : glibc (2026-ced72ab158)	Nessus	Fedora Local Security Checks	critical
310917	Linux Distros Unpatched Vulnerability : CVE-2026-6238	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-6238

medium

Tenable Plugins

high

critical

critical

medium