CVE-2026-89092: 
Wolfi vulnerability analysis and mitigation

CVE-2026-89092 is a stack overflow vulnerability in the nscd (Name Service Cache Daemon) component of the GNU C Library (glibc), tracked under the advisory GLIBC-SA-2026-0016. It affects glibc versions 2.3.4 through 2.44 (fixed in 2.45), and can be triggered when a malicious DNS server returns an oversized response to a DNS query, causing the nscd service to crash and degrading DNS resolution. The vulnerability was reported by Anmol Singh Rajput and publicly disclosed on September 10–11, 2026. It carries a CVSS v3.1 base score of 4.2 (Medium) (Red Hat Advisory, Github Advisory, Openwall OSS-Sec).

The root cause is unbounded use of alloca() in the nscd DNS response handling code path, classified as CWE-120 (Buffer Copy without Checking Size of Input) and CWE-789 (Memory Allocation with Excessive Size Value). When nscd processes a DNS response, it allocates stack memory proportional to the response size without enforcing an upper bound, allowing a sufficiently large DNS record to overflow the nscd thread stack. Exploitation requires: (1) nscd must be enabled on the target system, (2) the system must be configured to use an untrusted or attacker-controlled DNS server, and (3) the DNS server must be capable of returning records large enough to trigger the overflow — notably, bind 9 was found unable to produce such records during testing. The vulnerable commit is identified as d19687d6ebc545b633e14c07429f7892a599d0b9 (Openwall OSS-Sec, Red Hat Bugzilla).

The primary impact is a crash of the nscd service, resulting in performance degradation of DNS name resolution on the affected system; this does not constitute a full denial of service since the system can still resolve names through other means. There is no confidentiality impact. A low-probability secondary impact exists: if an attacker can precisely control the stack pointer to overlap with the nscd heap, nscd cache corruption may occur, potentially causing other cached data (e.g., user, group, or host caches) to be overwritten with attacker-influenced data, with low integrity impact. Because nscd typically runs as an isolated, unprivileged user without a shell, any compromise of the service is contained and does not directly enable lateral movement or privilege escalation (Red Hat Bugzilla, Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-89092. The EPSS score is 0.0, reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by high attack complexity — requiring adjacent network access, control of a DNS server capable of generating oversized records, and nscd being enabled and pointed at the attacker-controlled server (Github Advisory, Openwall OSS-Sec).

1. Reconnaissance: Identify target systems running glibc 2.3.4–2.44 with nscd enabled (e.g., via systemctl status nscd or checking /etc/nscd.conf), and confirm the system uses an externally controllable or untrusted DNS resolver.
2. Set up malicious DNS server: Deploy a custom DNS server capable of returning DNS responses with records large enough to overflow an nscd thread stack (note: standard servers like bind 9 may not support records of sufficient size).
3. Position as DNS resolver: Redirect the target system's DNS queries to the attacker-controlled server via network-level interception (e.g., ARP spoofing, DHCP poisoning, or BGP hijacking on an adjacent network segment).
4. Trigger the overflow: Cause the target system to perform a DNS lookup (e.g., by initiating a network connection or waiting for a cached entry to expire), prompting nscd to query the malicious DNS server and receive an oversized response.
5. Achieve impact: The oversized response triggers the unbounded alloca() call, overflowing the nscd thread stack and crashing the nscd process, degrading DNS resolution. Optionally, with precise heap/stack manipulation, attempt nscd cache corruption for low-integrity data tampering (Openwall OSS-Sec, Red Hat Bugzilla).

• Logs: Unexpected nscd crash entries in /var/log/syslog or journalctl -u nscd (e.g., segmentation fault or stack overflow messages from the nscd process); repeated nscd restarts logged by systemd.
• Process: nscd process terminating unexpectedly or being restarted by the service manager; absence of the nscd socket at /var/run/nscd/socket following a crash.
• Network: DNS queries from the target system directed to an unexpected or unauthorized DNS server IP; unusually large DNS response packets (>512 bytes over UDP or abnormally large TCP DNS responses) from an external server.
• File System: Core dump files generated by nscd in /var/lib/systemd/coredump/ or configured core dump directory, potentially indicating a crash event.

Upgrade glibc to version 2.45 or later, which contains the fix for this vulnerability (Openwall OSS-Sec). As a workaround, disable the nscd service if it is not required (systemctl disable --now nscd), which eliminates the attack surface entirely. Additionally, ensure that systems only use trusted, internal DNS resolvers and restrict network-level access to prevent DNS response spoofing (e.g., enforce DNSSEC, use DNS-over-TLS/HTTPS). The glibc advisory is tracked as GLIBC-SA-2026-0016 (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability was disclosed via the oss-security mailing list by Siddhesh Poyarekar on September 10, 2026, with a detailed advisory noting the limited real-world exploitability due to the high attack complexity and nscd's isolated execution context (Openwall OSS-Sec). Red Hat opened a security tracking bug and assigned it medium priority/severity, consistent with the CVSS score (Red Hat Bugzilla). No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.