stack overflow when a malicious DNS server returns too large a response
for a DNS query, resulting in degraded DNS resolution for the system.
Exploitation of this bug needs a system that has nscd enabled and using
an untrusted DNS server for name resolution, with the compromised DNS
server being capable of processing records large enough to result in a
stack overflow in an nscd thread stack. During experimentation, bind 9
was unable to handle large records, but that could change in future or
with a different name server. In typical installations, nscd is
executed in an isolated context as its own user without a shell, due to
which any compromise of that service is isolated.
There is a remote possibility of nscd cache corruption if an attacker
manages to get the stack pointer into a desired point in the heap,
potentially resulting in other caches in nscd being overwritten with
corrupt data through the stack overflow, until the buggy code path
eventually results in a crash.
Finally, a crash in nscd may result in performance degradation when
resolving names, but it does not result in a denial of service.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| The GNU C Library | glibc | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 11 Sep 2026 04:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Fri, 11 Sep 2026 01:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack. During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server. In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service. | |
| Title | Stack overflow in nscd due to unbounded alloca use | |
| Weaknesses | CWE-789 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: glibc
Published:
Updated: 2026-09-11T03:09:09.108Z
Reserved: 2026-09-10T20:18:09.584Z
Link: CVE-2026-89092
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-11T02:18:35.460
Modified: 2026-09-11T04:18:02.977
Link: CVE-2026-89092
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-09-11T03:30:16Z
-
CWE-789
Memory Allocation with Excessive Size Value