The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786529874 advisory.

  - The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer     fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing     TSIG records. (CVE-2026-5435)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer     fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing     TSIG records.(CVE-2026-5435)

    The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to     version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing     A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target     application to crash or read uninitialized memory.

    These functions are for application debugging only and hence not in the path of code executed by the DNS     resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new     applications.  Applications should consider porting away from these interfaces since they may be removed     in future versions.(CVE-2026-6238)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization glibc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough     space for the assertion failure message string and size information, which may lead to a buffer overflow     if the message string size aligns to page size.(CVE-2025-0395)

    Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38     allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries     that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as     getaddrinfo).(CVE-2025-4802)

    The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some     previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed     malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how     the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C     library.(CVE-2025-8058)

    Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to     version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on     subsequent calls to wordfree may abort the process.(CVE-2025-15281)

    Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign,     aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could     consequently result in a heap corruption.Note that the attacker must have control over both, the size as     well as the alignment arguments of the memalign function to be able to exploit this.  The size parameter     must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument.
    This limits the malicious inputs for the alignment for memalign to the range [162+ 1, 163] and     exactly 163 for posix_memalign and aligned_alloc.Typically the alignment argument passed to such     functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker     controlled, because of which this may not be easily exploitable in practice.  An application bug could     potentially result in the input alignment being too large, e.g. due to a different buffer overflow or     integer overflow in the application or its dependent libraries, but that is again an uncommon usage     pattern given typical sources of alignments.(CVE-2026-0861)

    Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS     backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version     2.42 can leak stack contents to the configured DNS resolver.(CVE-2026-0915)

    The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure     when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an     application.This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character     sets from systems that do not need them.(CVE-2026-4046)

    Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version     2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in     a one byte heap buffer overflow.(CVE-2026-5450)

    Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has     overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or     earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in     unintentional disclosure of neighboring data in the heap, or a program crash.A bug in the wide character     pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the     regular character buffer (fp-_IO_read_ptr) instead of the actual wide-stream read pointer (fp-
    _wide_data-_IO_read_ptr). The program crash may happen in cases where fp-_IO_read_ptr is not     initialized and hence points to NULL. The buffer under-read requires a special situation where the input     character encoding is such that there are overlaps between single byte representations and multibyte     representations in that encoding, resulting in spurious matches. The spurious match case is not possible     in the standard Unicode character sets.(CVE-2026-5928)

    The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer     fail to validate the RDATA content against the RDATA length in a DNS response when processing LOC, CERT,     TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to     crash or read uninitialized memory.These functions are for application debugging only and hence not in the     path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and     should not be used by any new applications.  Applications should consider porting away from these     interfaces since they may be removed in future versions.(CVE-2026-6238)

    The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer     fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing     TSIG records.(CVE-2026-5435)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization glibc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786529874 advisory.

  - The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer     fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing     TSIG records. (CVE-2026-5435)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
351792	AlmaLinux 9.6 [TuxCare] Security Update: compat-libpthread-nonshared / glibc / glibc-all-langpacks / etc (ALMALINUX9.6:CLSA-2026:1786529874)	Nessus	Alma Linux Local Security Checks	9/30/2026	9/30/2026	high
348503	EulerOS Virtualization 2.10.1 : glibc (EulerOS-SA-2026-3832)	Nessus	Huawei Local Security Checks	9/21/2026	9/21/2026	high
347077	EulerOS Virtualization 2.11.1 : glibc (EulerOS-SA-2026-3417)	Nessus	Huawei Local Security Checks	9/18/2026	9/21/2026	medium
347085	EulerOS Virtualization 2.11.0 : glibc (EulerOS-SA-2026-3504)	Nessus	Huawei Local Security Checks	9/18/2026	9/21/2026	medium
351619	Rocky Linux 9.6 [TuxCare] Security Update: compat-libpthread-nonshared / glibc / glibc-all-langpacks / etc (ALMALINUX9.6:CLSA-2026:1786529874)	Nessus	Rocky Linux Local Security Checks	9/30/2026	9/30/2026	high

Detections

Analytics

Plugins Search

high

high

medium

medium

high