The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack. During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server. In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4591-1 advisory.

    - CVE-2026-6368: wordexp WRDE_APPEND rollback restores stale we_wordv, leading to invalid free in wordfree       (bsc#1274726).
    - CVE-2026-6791: wordexp: unbounded alloca (strndupa) in parse_tilde (bsc#1274723).
    - CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local     network to       trigger a process crash (bsc#1281297).
    - CVE-2026-18374: overflow in the fopen ccs extension (bsc#1277262).
    - CVE-2026-19542: Fix out-of-bounds array write in tdelete (bsc#1276946).
    - CVE-2026-77117: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277921).
    - CVE-2026-80489: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277922).
    - CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate     privileges       (bsc#1282509).
    - CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
    - CVE-2026-97399: one byte out-of-bounds read via function `strncasecmp` on Power8 can lead to a program     crash       (bsc#1283147).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4656-1 advisory.

    - CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local     network to       trigger a process crash (bsc#1281297).
    - CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate     privileges       (bsc#1282509).
    - CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
    - CVE-2026-97399: one byte out-of-bounds read via function `strncasecmp` on Power8 can lead to a program     crash       (bsc#1283147).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4654-1 advisory.

    - CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate     privileges       (bsc#1282509).
    - CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS
    server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system.
    Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name
    resolution, with the compromised DNS server being capable of processing records large enough to result in
    a stack overflow in an nscd thread stack. During experimentation, bind 9 was unable to handle large
    records, but that could change in future or with a different name server. In typical installations, nscd
    is executed in an isolated context as its own user without a shell, due to which any compromise of that
    service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get
    the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being
    overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in
    a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does
    not result in a denial of service. (CVE-2026-89092)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS     server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system.
    Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name     resolution, with the compromised DNS server being capable of processing records large enough to result in     a stack overflow in an nscd thread stack. During experimentation, bind 9 was unable to handle large     records, but that could change in future or with a different name server. In typical installations, nscd     is executed in an isolated context as its own user without a shell, due to which any compromise of that     service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get     the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being     overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in     a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does     not result in a denial of service. (CVE-2026-89092)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
369268	SUSE SLES15: glibc / glibc-32bit / glibc-devel / glibc-devel-32bit / etc (SUSE-SU-2026:4591-1)	Nessus	SuSE Local Security Checks	Local	critical
366065	SUSE SLED15: glibc / glibc-32bit / glibc-devel / glibc-devel-32bit / etc (SUSE-SU-2026:4656-1)	Nessus	SuSE Local Security Checks	Local	medium
366060	SUSE SLES12: glibc / glibc-32bit / glibc-devel / glibc-devel-32bit / etc (SUSE-SU-2026:4654-1)	Nessus	SuSE Local Security Checks	Local	medium
473592	Chainguard: multiple glibc-2.44 packages, multiple ld-linux-2.44 packages, multiple nscd-2.44 packages, multiple pcprofiledump-2.44 packages, multiple sln-2.44 packages, tzutils-2.44: security update to 2.44-r8	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
473592	Chainguard: multiple glibc-2.44 packages, multiple ld-linux-2.44 packages, multiple nscd-2.44 packages, multiple pcprofiledump-2.44 packages, multiple sln-2.44 packages, tzutils-2.44: security update to 2.44-r8	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
464285	Echo: glibc: security update to 2.41-12+deb13u4+e4	Tenable Cloud Security	Echo Local Security Checks	Local	medium
464285	Echo: glibc: security update to 2.41-12+deb13u4+e4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
344689	Linux Distros Unpatched Vulnerability : CVE-2026-89092	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-89092

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium