Threats Tagged 'cve-2026-5435'

Red Hat OpenShift distributed tracing platform (Tempo) 3.10.2 includes multiple security improvements addressing vulnerabilities in underlying components such as the Go language packages and the GNU C Library. These fixes resolve issues including incorrect processing of Punycode labels, symbolic link traversal outside root directories, mishandling of wide character encodings, buffer overflows in DNS TSIG record processing, and crashes or uninitialized memory reads from malformed DNS responses. No breaking changes or deprecations are introduced in this release.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928) * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435) * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.