stack overflow when a malicious DNS server returns too large a response
for a DNS query, resulting in degraded DNS resolution for the system.
Exploitation of this bug needs a system that has nscd enabled and using
an untrusted DNS server for name resolution, with the compromised DNS
server being capable of processing records large enough to result in a
stack overflow in an nscd thread stack. During experimentation, bind 9
was unable to handle large records, but that could change in future or
with a different name server. In typical installations, nscd is
executed in an isolated context as its own user without a shell, due to
which any compromise of that service is isolated.
There is a remote possibility of nscd cache corruption if an attacker
manages to get the stack pointer into a desired point in the heap,
potentially resulting in other caches in nscd being overwritten with
corrupt data through the stack overflow, until the buggy code path
eventually results in a crash.
Finally, a crash in nscd may result in performance degradation when
resolving names, but it does not result in a denial of service.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Fri, 11 Sep 2026 04:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Fri, 11 Sep 2026 01:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack. During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server. In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service. | |
| Title | Stack overflow in nscd due to unbounded alloca use | |
| Weaknesses | CWE-789 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: glibc
Published:
Updated: 2026-09-11T03:09:09.108Z
Reserved: 2026-09-10T20:18:09.584Z
Link: CVE-2026-89092
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-11T02:18:35.460
Modified: 2026-09-11T04:18:02.977
Link: CVE-2026-89092
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-09-11T03:30:16Z