The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack. During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server. In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS
    server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system.
    Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name
    resolution, with the compromised DNS server being capable of processing records large enough to result in
    a stack overflow in an nscd thread stack. During experimentation, bind 9 was unable to handle large
    records, but that could change in future or with a different name server. In typical installations, nscd
    is executed in an isolated context as its own user without a shell, due to which any compromise of that
    service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get
    the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being
    overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in
    a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does
    not result in a denial of service. (CVE-2026-89092)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS     server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system.
    Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name     resolution, with the compromised DNS server being capable of processing records large enough to result in     a stack overflow in an nscd thread stack. During experimentation, bind 9 was unable to handle large     records, but that could change in future or with a different name server. In typical installations, nscd     is executed in an isolated context as its own user without a shell, due to which any compromise of that     service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get     the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being     overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in     a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does     not result in a denial of service. (CVE-2026-89092)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
464285	Echo: glibc: security update to 2.41-12+deb13u4+e2	Tenable Cloud Security	Echo Local Security Checks	Local	medium
464285	Echo: glibc: security update to 2.41-12+deb13u4+e2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
344689	Linux Distros Unpatched Vulnerability : CVE-2026-89092	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-89092

medium

Tenable Plugins

medium

medium

medium