Skip to content
Fencer Intel
medium 6.2

CVE-2026-3904 json

Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under h…

published 7mo ago modified 25d ago also EUVD-2026-11160

cvss
6.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits
0
none known

Summary

Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client may call memcmp on inputs that are concurrently modified by other processes or threads and crash.

The nscd client in the GNU C Library uses the memcmp function with inputs that may be concurrently modified by another thread, potentially resulting in spurious cache misses, which in itself is not a security issue.  However in the GNU C Library version 2.36 an optimized implementation of memcmp was introduced for x86_64 which could crash when invoked with such undefined behaviour, turning this into a potential crash of the nscd client and the application that uses it. This implementation was backported to the 2.35 branch, making the nscd client in that branch vulnerable as well.  Subsequently, the fix for this issue was backported to all vulnerable branches in the GNU C Library repository.

It is advised that distributions that may have cherry-picked the memcpy SSE2 optimization in their copy of the GNU C Library, also apply the fix to avoid the potential crash in the nscd client.

Patch / fix

  • The GNU C Library glibc 2.37
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • glibc Debian 14, Debian 13, Debian 12 2.36-9

debian advisories DEBIAN-CVE-2026-3904

  • glibc hummingbird 1 2.42-11.1.hum1
  • glibc32 hummingbird 1 2.42-11.1.hum1
  • glibc-utils hummingbird 1 2.42-11.1.hum1
  • glibc-common hummingbird 1 2.42-11.1.hum1
  • glibc-benchtests hummingbird 1 2.42-11.1.hum1
  • glibc-gconv-extra hummingbird 1 2.42-11.1.hum1
  • glibc-all-langpacks hummingbird 1 2.42-11.1.hum1
  • glibc-locale-source hummingbird 1 2.42-11.1.hum1

red hat advisories RHSA-2026:7316

Is CVE-2026-3904 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-3904 updated cvss 5.9

glibc: nscd client crash on x86_64 under high nscd load

  • Red Hat Hardened Images glibc 2.42-11.1.hum1, glibc32 2.42-11.1.hum1, glibc-utils 2.42-11.1.hum1, glibc-common 2.42-11.1.hum1, glibc-benchtests 2.42-11.1.hum1, glibc-gconv-extra 2.42-11.1.hum1, +5 more
    fixed: vendor fix RHSA-2026:7316
  • Red Hat Enterprise Linux 6 nscd, glibc, glibc-utils, compat-glibc, glibc-common Red Hat Enterprise Linux 7 nscd, glibc, glibc-utils, compat-glibc, glibc-common Red Hat Enterprise Linux 8 nscd, glibc, libnsl, nss_db, nss_hesiod, glibc-utils, +7 more Red Hat Enterprise Linux 9 nscd, glibc, libnsl, nss_db, nss_hesiod, glibc-utils, +6 more Red Hat Enterprise Linux 10 glibc Red Hat Hardened Images libnsl 2.42-11.1.hum1, nss_db 2.42-11.1.hum1, nss_hesiod 2.42-11.1.hum1, compat-libpthread-nonshared 2.42-11.1.hum1
    +1 more products
    Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
7mo ago

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • sourceware.org https://sourceware.org/bugzilla/show_bug.cgi?id=29863 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • The GNU C Library glibc
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
  • CWE-366 Race Condition within a Thread

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.