CVE-2026-5435 Details
Description
The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.
A buffer overflow vulnerability has been identified in the GNU C Library (glibc) versions 2.2 and newer. The issue arises in the deprecated functions ns_printrrf, ns_printrr, and fp_nquery, which fail to properly validate the length of caller-supplied buffers when processing TSIG records. This oversight can lead to out-of-bounds writes, potentially overwriting memory and causing application crashes. The vulnerability is not present in the default DNS resolver operation but affects public DNS packet-printing APIs that may be used to process untrusted DNS messages.
Users are advised to avoid using the affected functions, as they have been deprecated since glibc version 2.34. Applications should be updated to remove reliance on these interfaces.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-082556.html | siemens-SADP | |
| https://inbox.sourceware.org/libc-announce/[email protected]/T/#u | GNU C Library | Third Party Advisory |
| https://sourceware.org/bugzilla/show_bug.cgi?id=34033 | GNU C Library | Issue Tracking |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | GNU C Library |
Affected Products
| Product | Versions |
|---|---|
| gnu glibc | >= 2.2 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | siemens-SADP |
| Jun 17, 2026 | CVE Modified | GNU C Library |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | Initial Analysis | [email protected] |
| Apr 28, 2026 | CVE Modified | CISA-ADP |
| Apr 28, 2026 | New CVE Received | GNU C Library |