An update for glibc is now available for openEuler-24.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4283 Final 1.0 1.0 2026-10-16 Initial 2026-10-16 2026-10-16 openEuler SA Tool V1.0 2026-10-16 glibc security update An update for glibc is now available for openEuler-24.03-LTS-SP4 The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more. Security Fix(es): The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.(CVE-2026-89092) An update for glibc is now available for openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium glibc https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4283 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-89092 https://nvd.nist.gov/vuln/detail/CVE-2026-89092 openEuler-24.03-LTS-SP4 glibc-2.38-130.oe2403sp4.aarch64.rpm glibc-all-langpacks-2.38-130.oe2403sp4.aarch64.rpm glibc-common-2.38-130.oe2403sp4.aarch64.rpm glibc-debuginfo-2.38-130.oe2403sp4.aarch64.rpm glibc-debugsource-2.38-130.oe2403sp4.aarch64.rpm glibc-debugutils-2.38-130.oe2403sp4.aarch64.rpm glibc-devel-2.38-130.oe2403sp4.aarch64.rpm glibc-locale-archive-2.38-130.oe2403sp4.aarch64.rpm glibc-locale-source-2.38-130.oe2403sp4.aarch64.rpm glibc-nss-devel-2.38-130.oe2403sp4.aarch64.rpm libnsl-2.38-130.oe2403sp4.aarch64.rpm nscd-2.38-130.oe2403sp4.aarch64.rpm nss_modules-2.38-130.oe2403sp4.aarch64.rpm glibc-2.38-130.oe2403sp4.src.rpm glibc-2.38-130.oe2403sp4.x86_64.rpm glibc-all-langpacks-2.38-130.oe2403sp4.x86_64.rpm glibc-common-2.38-130.oe2403sp4.x86_64.rpm glibc-debuginfo-2.38-130.oe2403sp4.x86_64.rpm glibc-debugsource-2.38-130.oe2403sp4.x86_64.rpm glibc-debugutils-2.38-130.oe2403sp4.x86_64.rpm glibc-devel-2.38-130.oe2403sp4.x86_64.rpm glibc-locale-archive-2.38-130.oe2403sp4.x86_64.rpm glibc-locale-source-2.38-130.oe2403sp4.x86_64.rpm glibc-nss-devel-2.38-130.oe2403sp4.x86_64.rpm libnsl-2.38-130.oe2403sp4.x86_64.rpm nscd-2.38-130.oe2403sp4.x86_64.rpm nss_modules-2.38-130.oe2403sp4.x86_64.rpm glibc-help-2.38-130.oe2403sp4.noarch.rpm The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service. 2026-10-16 CVE-2026-89092 openEuler-24.03-LTS-SP4 Medium 4.2 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L glibc security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4283