According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version     2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in     a one byte heap buffer overflow.(CVE-2026-5450)

    Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has     overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or     earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in     unintentional disclosure of neighboring data in the heap, or a program crash.A bug in the wide character     pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the     regular character buffer (fp-_IO_read_ptr) instead of the actual wide-stream read pointer (fp-
    _wide_data-_IO_read_ptr). The program crash may happen in cases where fp-_IO_read_ptr is not     initialized and hence points to NULL. The buffer under-read requires a special situation where the input     character encoding is such that there are overlaps between single byte representations and multibyte     representations in that encoding, resulting in spurious matches. The spurious match case is not possible     in the standard Unicode character sets.(CVE-2026-5928)

    The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure     when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an     application.This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character     sets from systems that do not need them.(CVE-2026-4046)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization glibc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of glibc installed on the remote host is prior to 2.26-64. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3272 advisory.

    The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure     when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an     application.



    This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from     systems that do not need them. (CVE-2026-4046)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:20594 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:20587 advisory.

    * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:20587 advisory.

    * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:20597 advisory.

    * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)

    * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)

    * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has     overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or     earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in     unintentional disclosure of neighboring data in the heap, or a program crash.A bug in the wide character     pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the     regular character buffer (fp-_IO_read_ptr) instead of the actual wide-stream read pointer (fp-
    _wide_data-_IO_read_ptr). The program crash may happen in cases where fp-_IO_read_ptr is not     initialized and hence points to NULL. The buffer under-read requires a special situation where the input     character encoding is such that there are overlaps between single byte representations and multibyte     representations in that encoding, resulting in spurious matches. The spurious match case is not possible     in the standard Unicode character sets.(CVE-2026-5928)

    The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure     when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an     application.This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character     sets from systems that do not need them.(CVE-2026-4046)

    Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version     2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in     a one byte heap buffer overflow.(CVE-2026-5450)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization glibc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has     overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or     earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in     unintentional disclosure of neighboring data in the heap, or a program crash.A bug in the wide character     pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the     regular character buffer (fp-_IO_read_ptr) instead of the actual wide-stream read pointer (fp-
    _wide_data-_IO_read_ptr). The program crash may happen in cases where fp-_IO_read_ptr is not     initialized and hence points to NULL. The buffer under-read requires a special situation where the input     character encoding is such that there are overlaps between single byte representations and multibyte     representations in that encoding, resulting in spurious matches. The spurious match case is not possible     in the standard Unicode character sets.(CVE-2026-5928)

    Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version     2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in     a one byte heap buffer overflow.(CVE-2026-5450)

    The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure     when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an     application.This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character     sets from systems that do not need them.(CVE-2026-4046)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization glibc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version     2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in     a one byte heap buffer overflow.(CVE-2026-5450)

    Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has     overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or     earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in     unintentional disclosure of neighboring data in the heap, or a program crash._x000D_
    _x000D_     A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes     ungetwc() to operate on the regular character buffer (fp-_IO_read_ptr) instead of the actual wide-     stream read pointer (fp-_wide_data-_IO_read_ptr). The program crash may happen in cases where fp-
    _IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special     situation where the input character encoding is such that there are overlaps between single byte     representations and multibyte representations in that encoding, resulting in spurious matches. The     spurious match case is not possible in the standard Unicode character sets.(CVE-2026-5928)

    The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure     when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an     application._x000D_
    _x000D_
    _x000D_
    _x000D_     This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from     systems that do not need them.(CVE-2026-4046)

Tenable has extracted the preceding description block directly from the EulerOS glibc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2333-1 advisory.

    This update for glibc fixes the following issues

    - CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application     (bsc#1261206).
    - CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
    - CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the glibc package has been released.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:20587 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-20587 advisory.

    - Add tests for CVE-2026-4437 and CVE-2026-4438 (RHEL-173358)
    - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules       (RHEL-162891)
    - CVE-2025-15281: wordexp WRDE_REUSE uninitialized memory read (RHEL-142787)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure     when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an     application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character     sets from systems that do not need them. (CVE-2026-4046)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
320705	EulerOS Virtualization 2.13.0 : glibc (EulerOS-SA-2026-2399)	Nessus	Huawei Local Security Checks	2026/6/12	2026/6/12	critical
311224	Amazon Linux 2 : glibc, --advisory ALAS2-2026-3272 (ALAS-2026-3272)	Nessus	Amazon Linux Local Security Checks	2026/4/30	2026/4/30	high
316774	RHEL 10 : glibc (RHSA-2026:20594)	Nessus	Red Hat Local Security Checks	2026/5/26	2026/5/26	high
317112	AlmaLinux 8 : glibc (ALSA-2026:20587)	Nessus	Alma Linux Local Security Checks	2026/5/27	2026/5/27	high
317488	RockyLinux 8 : glibc (RLSA-2026:20587)	Nessus	Rocky Linux Local Security Checks	2026/5/29	2026/5/29	high
318034	RockyLinux 9 : glibc (RLSA-2026:20597)	Nessus	Rocky Linux Local Security Checks	2026/5/30	2026/7/17	medium
328521	EulerOS Virtualization 2.12.0 : glibc (EulerOS-SA-2026-2772)	Nessus	Huawei Local Security Checks	2026/7/21	2026/7/21	critical
328578	EulerOS Virtualization 2.10.1 : glibc (EulerOS-SA-2026-2819)	Nessus	Huawei Local Security Checks	2026/7/21	2026/7/21	critical
320226	EulerOS 2.0 SP13 : glibc (EulerOS-SA-2026-2333)	Nessus	Huawei Local Security Checks	2026/6/10	2026/6/10	critical
320234	EulerOS 2.0 SP13 : glibc (EulerOS-SA-2026-2290)	Nessus	Huawei Local Security Checks	2026/6/10	2026/6/10	critical
321044	SUSE SLES15 Security Update : glibc (SUSE-SU-2026:2333-1)	Nessus	SuSE Local Security Checks	2026/6/14	2026/6/14	critical
306996	Photon OS 5.0: Glibc PHSA-2026-5.0-0824	Nessus	PhotonOS Local Security Checks	2026/4/17	2026/4/17	high
316822	RHEL 8 : glibc (RHSA-2026:20587)	Nessus	Red Hat Local Security Checks	2026/5/26	2026/5/26	high
317084	Oracle Linux 8 : glibc (ELSA-2026-20587)	Nessus	Oracle Linux Local Security Checks	2026/5/27	2026/5/27	high
304363	Linux Distros Unpatched Vulnerability : CVE-2026-4046	Nessus	Misc.	2026/3/31	2026/7/27	high

检测

插件搜索

critical

high

high

high

high

medium

critical

critical

critical

critical

critical

high

high

high

high