Vulnerability-Lookup

ubuntu-cve-2026-3904

Vulnerability from osv_ubuntu

Published

2026-03-12 00:00

Modified

2026-03-12 00:00

Summary

Details

(Calling NSS-backed functions that support caching via nscd may call th ...)

Severity

6.2 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-3904	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-3904	REPORT
	https://sourceware.org/git/?p=glibc.git;a=blob;f=…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "eglibc-source",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-armel",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-dev",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-dev-armel",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-pic",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-prof",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "multiarch-support",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "eglibc",
        "purl": "pkg:deb/ubuntu/eglibc@2.19-0ubuntu6.15+esm4?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.17-93ubuntu4",
        "2.18-0ubuntu1",
        "2.18-0ubuntu2",
        "2.18-0ubuntu4",
        "2.18-0ubuntu5",
        "2.18-0ubuntu6",
        "2.18-0ubuntu7",
        "2.19-0ubuntu2",
        "2.19-0ubuntu3",
        "2.19-0ubuntu4",
        "2.19-0ubuntu5",
        "2.19-0ubuntu6",
        "2.19-0ubuntu6.1",
        "2.19-0ubuntu6.3",
        "2.19-0ubuntu6.4",
        "2.19-0ubuntu6.5",
        "2.19-0ubuntu6.6",
        "2.19-0ubuntu6.7",
        "2.19-0ubuntu6.8",
        "2.19-0ubuntu6.9",
        "2.19-0ubuntu6.10",
        "2.19-0ubuntu6.11",
        "2.19-0ubuntu6.13",
        "2.19-0ubuntu6.14",
        "2.19-0ubuntu6.15",
        "2.19-0ubuntu6.15+esm1",
        "2.19-0ubuntu6.15+esm2",
        "2.19-0ubuntu6.15+esm3",
        "2.19-0ubuntu6.15+esm4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "glibc-source",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-armel",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-dev",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-dev-armel",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-dev-s390",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-pic",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-s390",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "locales",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "locales-all",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "multiarch-support",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "glibc",
        "purl": "pkg:deb/ubuntu/glibc@2.23-0ubuntu11.3+esm9?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.21-0ubuntu4",
        "2.21-0ubuntu5",
        "2.21-0ubuntu6",
        "2.23-0ubuntu1",
        "2.23-0ubuntu2",
        "2.23-0ubuntu3",
        "2.23-0ubuntu4",
        "2.23-0ubuntu5",
        "2.23-0ubuntu6",
        "2.23-0ubuntu7",
        "2.23-0ubuntu9",
        "2.23-0ubuntu10",
        "2.23-0ubuntu11",
        "2.23-0ubuntu11.2",
        "2.23-0ubuntu11.3",
        "2.23-0ubuntu11.3+esm1",
        "2.23-0ubuntu11.3+esm2",
        "2.23-0ubuntu11.3+esm3",
        "2.23-0ubuntu11.3+esm5",
        "2.23-0ubuntu11.3+esm6",
        "2.23-0ubuntu11.3+esm7",
        "2.23-0ubuntu11.3+esm8",
        "2.23-0ubuntu11.3+esm9"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "glibc-source",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-armel",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-dev",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-dev-armel",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-dev-s390",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-lse",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-pic",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-s390",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "locales",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "locales-all",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "multiarch-support",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "glibc",
        "purl": "pkg:deb/ubuntu/glibc@2.27-3ubuntu1.6+esm6?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.26-0ubuntu2",
        "2.26-0ubuntu2.1",
        "2.27-0ubuntu2",
        "2.27-0ubuntu3",
        "2.27-3ubuntu1",
        "2.27-3ubuntu1.2",
        "2.27-3ubuntu1.3",
        "2.27-3ubuntu1.4",
        "2.27-3ubuntu1.5",
        "2.27-3ubuntu1.6",
        "2.27-3ubuntu1.6+esm1",
        "2.27-3ubuntu1.6+esm2",
        "2.27-3ubuntu1.6+esm3",
        "2.27-3ubuntu1.6+esm4",
        "2.27-3ubuntu1.6+esm5",
        "2.27-3ubuntu1.6+esm6"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "glibc-source",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-armel",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-dev",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-dev-armel",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-dev-s390",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-lse",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-pic",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-prof",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-s390",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "locales",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "locales-all",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "glibc",
        "purl": "pkg:deb/ubuntu/glibc@2.31-0ubuntu9.18+esm1?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.30-0ubuntu2",
        "2.30-0ubuntu3",
        "2.31-0ubuntu5",
        "2.31-0ubuntu6",
        "2.31-0ubuntu7",
        "2.31-0ubuntu9",
        "2.31-0ubuntu9.1",
        "2.31-0ubuntu9.2",
        "2.31-0ubuntu9.3",
        "2.31-0ubuntu9.7",
        "2.31-0ubuntu9.9",
        "2.31-0ubuntu9.12",
        "2.31-0ubuntu9.14",
        "2.31-0ubuntu9.15",
        "2.31-0ubuntu9.16",
        "2.31-0ubuntu9.17",
        "2.31-0ubuntu9.18",
        "2.31-0ubuntu9.18+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "glibc-source",
            "binary_version": "2.35-0ubuntu3.13"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.35-0ubuntu3.13"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.35-0ubuntu3.13"
          },
          {
            "binary_name": "libc-devtools",
            "binary_version": "2.35-0ubuntu3.13"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.35-0ubuntu3.13"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.35-0ubuntu3.13"
          },
          {
            "binary_name": "libc6-dev",
            "binary_version": "2.35-0ubuntu3.13"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.35-0ubuntu3.13"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.35-0ubuntu3.13"
          },
          {
            "binary_name": "libc6-dev-s390",
            "binary_version": "2.35-0ubuntu3.13"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.35-0ubuntu3.13"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.35-0ubuntu3.13"
          },
          {
            "binary_name": "libc6-prof",
            "binary_version": "2.35-0ubuntu3.13"
          },
          {
            "binary_name": "libc6-s390",
            "binary_version": "2.35-0ubuntu3.13"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.35-0ubuntu3.13"
          },
          {
            "binary_name": "locales",
            "binary_version": "2.35-0ubuntu3.13"
          },
          {
            "binary_name": "locales-all",
            "binary_version": "2.35-0ubuntu3.13"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.35-0ubuntu3.13"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "glibc",
        "purl": "pkg:deb/ubuntu/glibc@2.35-0ubuntu3.13?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.34-0ubuntu3",
        "2.35-0ubuntu1",
        "2.35-0ubuntu3",
        "2.35-0ubuntu3.1",
        "2.35-0ubuntu3.3",
        "2.35-0ubuntu3.4",
        "2.35-0ubuntu3.5",
        "2.35-0ubuntu3.6",
        "2.35-0ubuntu3.7",
        "2.35-0ubuntu3.8",
        "2.35-0ubuntu3.9",
        "2.35-0ubuntu3.10",
        "2.35-0ubuntu3.11",
        "2.35-0ubuntu3.12",
        "2.35-0ubuntu3.13"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "glibc-source",
            "binary_version": "2.39-0ubuntu8.7"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.39-0ubuntu8.7"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.39-0ubuntu8.7"
          },
          {
            "binary_name": "libc-devtools",
            "binary_version": "2.39-0ubuntu8.7"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.39-0ubuntu8.7"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.39-0ubuntu8.7"
          },
          {
            "binary_name": "libc6-dev",
            "binary_version": "2.39-0ubuntu8.7"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.39-0ubuntu8.7"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.39-0ubuntu8.7"
          },
          {
            "binary_name": "libc6-dev-s390",
            "binary_version": "2.39-0ubuntu8.7"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.39-0ubuntu8.7"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.39-0ubuntu8.7"
          },
          {
            "binary_name": "libc6-s390",
            "binary_version": "2.39-0ubuntu8.7"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.39-0ubuntu8.7"
          },
          {
            "binary_name": "locales",
            "binary_version": "2.39-0ubuntu8.7"
          },
          {
            "binary_name": "locales-all",
            "binary_version": "2.39-0ubuntu8.7"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.39-0ubuntu8.7"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "glibc",
        "purl": "pkg:deb/ubuntu/glibc@2.39-0ubuntu8.7?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.38-1ubuntu6",
        "2.38-3ubuntu1",
        "2.39-0ubuntu1",
        "2.39-0ubuntu2",
        "2.39-0ubuntu6",
        "2.39-0ubuntu8",
        "2.39-0ubuntu8.1",
        "2.39-0ubuntu8.2",
        "2.39-0ubuntu8.3",
        "2.39-0ubuntu8.4",
        "2.39-0ubuntu8.5",
        "2.39-0ubuntu8.6",
        "2.39-0ubuntu8.7"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "glibc-source",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc-devtools",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc6-dev",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "locales",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "locales-all",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.42-0ubuntu3.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "glibc",
        "purl": "pkg:deb/ubuntu/glibc@2.42-0ubuntu3.1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.41-6ubuntu1",
        "2.41-6ubuntu2",
        "2.41-9ubuntu1",
        "2.42-0ubuntu1",
        "2.42-0ubuntu3",
        "2.42-0ubuntu3.1"
      ]
    }
  ],
  "aliases": [],
  "details": "(Calling NSS-backed functions that support caching via nscd may call th ...)",
  "id": "UBUNTU-CVE-2026-3904",
  "modified": "2026-03-12T00:00:00Z",
  "published": "2026-03-12T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-3904"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-3904"
    },
    {
      "type": "REPORT",
      "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0004"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-3904"
  ],
  "withdrawn": "2026-03-16T05:29:34Z"
}

CVE-2026-3904 (GCVE-0-2026-3904)

Vulnerability from cvelistv5 – Published: 2026-03-11 13:19 – Updated: 2026-07-14 12:45

Summary

Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client may call memcmp on inputs that are concurrently modified by other processes or threads and crash. The nscd client in the GNU C Library uses the memcmp function with inputs that may be concurrently modified by another thread, potentially resulting in spurious cache misses, which in itself is not a security issue. However in the GNU C Library version 2.36 an optimized implementation of memcmp was introduced for x86_64 which could crash when invoked with such undefined behaviour, turning this into a potential crash of the nscd client and the application that uses it. This implementation was backported to the 2.35 branch, making the nscd client in that branch vulnerable as well. Subsequently, the fix for this issue was backported to all vulnerable branches in the GNU C Library repository. It is advised that distributions that may have cherry-picked the memcpy SSE2 optimization in their copy of the GNU C Library, also apply the fix to avoid the potential crash in the nscd client.

Severity

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-366 - Race condition within a thread

Assigner

glibc

References

6 references

URL	Tags
https://sourceware.org/git/?p=glibc.git;a=blob_pl…
https://sourceware.org/bugzilla/show_bug.cgi?id=29863
https://sourceware.org/git/?p=glibc.git;a=commit;…
https://sourceware.org/git/?p=glibc.git;a=commit;…
http://www.openwall.com/lists/oss-security/2026/03/11/5
https://cert-portal.siemens.com/productcert/html/…

Impacted products

4 products

Vendor	Product	Version
The GNU C Library	glibc	Affected: 2.35 , < 2.37 (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < V3.1.6 (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < V3.1.6 (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < V3.1.6 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-11T15:16:39.402Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/11/5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.2,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-3904",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-11T15:56:03.349329Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-11T15:56:23.027Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.6",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.6",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.6",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.6",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.6",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:45:22.895Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "x86"
          ],
          "product": "glibc",
          "vendor": "The GNU C Library",
          "versions": [
            {
              "lessThan": "2.37",
              "status": "affected",
              "version": "2.35",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eCalling NSS-backed functions that support caching via nscd may call the \nnscd client side code and in the GNU C Library version 2.36 under high \nload on x86_64 systems, the client may call memcmp on inputs that are \nconcurrently modified by other processes or threads and crash.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThe nscd client in the GNU C Library uses the memcmp function with \ninputs that may be concurrently modified by another thread, potentially \nresulting in spurious cache misses, which in itself is not a security \nissue.\u0026nbsp; However in the GNU C Library version 2.36 an optimized \nimplementation of memcmp was introduced for x86_64 which could crash \nwhen invoked with such undefined behaviour, turning this into a \npotential crash of the nscd client and the application that uses it. \nThis implementation was backported to the 2.35 branch, making the nscd \nclient in that branch vulnerable as well.\u0026nbsp; Subsequently, the fix for \nthis issue was backported to all vulnerable branches in the GNU C \nLibrary repository.\u003cbr\u003e\n\u003cbr\u003eIt is advised that distributions that may have cherry-picked the memcpy \nSSE2 optimization in their copy of the GNU C Library, also apply the fix \nto avoid the potential crash in the nscd client.\u003c/div\u003e"
            }
          ],
          "value": "Calling NSS-backed functions that support caching via nscd may call the \nnscd client side code and in the GNU C Library version 2.36 under high \nload on x86_64 systems, the client may call memcmp on inputs that are \nconcurrently modified by other processes or threads and crash.\n\n\n\n\nThe nscd client in the GNU C Library uses the memcmp function with \ninputs that may be concurrently modified by another thread, potentially \nresulting in spurious cache misses, which in itself is not a security \nissue.\u00a0 However in the GNU C Library version 2.36 an optimized \nimplementation of memcmp was introduced for x86_64 which could crash \nwhen invoked with such undefined behaviour, turning this into a \npotential crash of the nscd client and the application that uses it. \nThis implementation was backported to the 2.35 branch, making the nscd \nclient in that branch vulnerable as well.\u00a0 Subsequently, the fix for \nthis issue was backported to all vulnerable branches in the GNU C \nLibrary repository.\n\n\nIt is advised that distributions that may have cherry-picked the memcpy \nSSE2 optimization in their copy of the GNU C Library, also apply the fix \nto avoid the potential crash in the nscd client."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-366",
              "description": "CWE-366 Race condition within a thread",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-11T13:19:09.741Z",
        "orgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
        "shortName": "glibc"
      },
      "references": [
        {
          "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0004;hb=HEAD"
        },
        {
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=29863"
        },
        {
          "url": "https://sourceware.org/git/?p=glibc.git;a=commit;h=8804157ad9da39631703b92315460808eac86b0c"
        },
        {
          "url": "https://sourceware.org/git/?p=glibc.git;a=commit;h=b712be52645282c706a5faa038242504feb06db5"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
    "assignerShortName": "glibc",
    "cveId": "CVE-2026-3904",
    "datePublished": "2026-03-11T13:19:09.741Z",
    "dateReserved": "2026-03-10T19:52:49.054Z",
    "dateUpdated": "2026-07-14T12:45:22.895Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2026-3904

Vulnerability from osv_ubuntu

CVE-2026-3904 (GCVE-0-2026-3904)

Tags

Sightings

Nomenclature