Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.1/patches/2229202/?format=api
{ "id": 2229202, "url": "http://patchwork.ozlabs.org/api/1.1/patches/2229202/?format=api", "web_url": "http://patchwork.ozlabs.org/project/glibc/patch/20260427215230.629899-1-carlos@redhat.com/", "project": { "id": 41, "url": "http://patchwork.ozlabs.org/api/1.1/projects/41/?format=api", "name": "GNU C Library", "link_name": "glibc", "list_id": "libc-alpha.sourceware.org", "list_email": "libc-alpha@sourceware.org", "web_url": "", "scm_url": "", "webscm_url": "" }, "msgid": "<20260427215230.629899-1-carlos@redhat.com>", "date": "2026-04-27T21:52:10", "name": "Add advisory text for CVE-2026-5435", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "d04b2c9001dcb6725a8cf70667b2ae240077e502", "submitter": { "id": 22438, "url": "http://patchwork.ozlabs.org/api/1.1/people/22438/?format=api", "name": "Carlos O'Donell", "email": "carlos@redhat.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/glibc/patch/20260427215230.629899-1-carlos@redhat.com/mbox/", "series": [ { "id": 501731, "url": "http://patchwork.ozlabs.org/api/1.1/series/501731/?format=api", "web_url": "http://patchwork.ozlabs.org/project/glibc/list/?series=501731", "date": "2026-04-27T21:52:10", "name": "Add advisory text for CVE-2026-5435", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/501731/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2229202/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2229202/checks/", "tags": {}, "headers": { "Return-Path": "<libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "libc-alpha@sourceware.org" ], "Delivered-To": [ "patchwork-incoming@legolas.ozlabs.org", "libc-alpha@sourceware.org" ], "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=gS+S3S2E;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org\n (client-ip=38.145.34.32; helo=vm01.sourceware.org;\n envelope-from=libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org;\n receiver=patchwork.ozlabs.org)", "sourceware.org;\n\tdkim=pass (1024-bit key,\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=gS+S3S2E", "sourceware.org; dmarc=pass (p=quarantine dis=none)\n header.from=redhat.com", "sourceware.org; spf=pass smtp.mailfrom=redhat.com", "server2.sourceware.org;\n arc=none smtp.remote-ip=170.10.133.124" ], "Received": [ "from vm01.sourceware.org (vm01.sourceware.org [38.145.34.32])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g4HP95w9Tz1yHX\n\tfor <incoming@patchwork.ozlabs.org>; Tue, 28 Apr 2026 07:53:01 +1000 (AEST)", "from vm01.sourceware.org (localhost [127.0.0.1])\n\tby sourceware.org (Postfix) with ESMTP id C70784BA2E2D\n\tfor <incoming@patchwork.ozlabs.org>; Mon, 27 Apr 2026 21:52:59 +0000 (GMT)", "from us-smtp-delivery-124.mimecast.com\n (us-smtp-delivery-124.mimecast.com [170.10.133.124])\n by sourceware.org (Postfix) with ESMTP id 55DF24BA5436\n for <libc-alpha@sourceware.org>; Mon, 27 Apr 2026 21:52:39 +0000 (GMT)", "from mail-qt1-f198.google.com (mail-qt1-f198.google.com\n [209.85.160.198]) by relay.mimecast.com with ESMTP with STARTTLS\n (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id\n us-mta-10-df0zBZAlNYypCbMWkmGgCQ-1; Mon, 27 Apr 2026 17:52:38 -0400", "by mail-qt1-f198.google.com with SMTP id\n d75a77b69052e-50da31af14cso286359071cf.1\n for <libc-alpha@sourceware.org>; Mon, 27 Apr 2026 14:52:37 -0700 (PDT)", "from codonell-thinkpadp16vgen1.rmtcaon.csb ([198.48.244.52])\n by smtp.gmail.com with ESMTPSA id\n d75a77b69052e-5100da4cbd3sm3346181cf.4.2026.04.27.14.52.34\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Mon, 27 Apr 2026 14:52:35 -0700 (PDT)" ], "DKIM-Filter": [ "OpenDKIM Filter v2.11.0 sourceware.org C70784BA2E2D", "OpenDKIM Filter v2.11.0 sourceware.org 55DF24BA5436" ], "DMARC-Filter": "OpenDMARC Filter v1.4.2 sourceware.org 55DF24BA5436", "ARC-Filter": "OpenARC Filter v1.0.0 sourceware.org 55DF24BA5436", "ARC-Seal": "i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1777326759; cv=none;\n b=Rb6AfkB0YpTnkxV419tyPT2FlOlUjH499X65HmwyHu1GHBibtHm2ajzKN74ejT4uYoybhVhjticX+AfwlGG1C5xgSdAl++yflllPUr/0UB+CecyuGT4Q/ChULBAF9DcrWrrtryr9gK4MFvo/g/ZZ+/Y3+e+W8dKrmnMp4ttNVrQ=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=sourceware.org; s=key;\n t=1777326759; c=relaxed/simple;\n bh=BVt2vL2Alb3PXyF1kTc9c6hDJJ6zdFuz+Aqz+nm1K38=;\n h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version;\n b=LS+b+eEomp3LNgy0rdxFzajBmbwj8+PpUm+r8pB3/HvUmcf+mLZNFsUkJeppAxEAlz96phaPWLlb1l5Mt9WFev3W78EuB7vlObLBoNswX6CeIpZPntqRPtw/qCKFjm7t3PM7rPUBeZ2orDuHUcUGEsxbmPZnncbFhOe1l2a6ico=", "ARC-Authentication-Results": "i=1; server2.sourceware.org", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1777326759;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:cc:mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding;\n bh=bPIyKZKTr0zc+cfebuiySCXCgqXc/8QrRE1Ir8djF+4=;\n b=gS+S3S2EtJtu1u4WNJhw+p5pX6aWVuz1yuSt14JEdXC18rvi5YTJVq7S81C/FrMhL2nCMF\n SgoXLsoEjYR3jjA55825rHM6gQrB+Si0LnNrwQF9jAoU5cvkFJvCGbFSCWZgjxXSIXqszM\n s6GTAiPlbH1maVJYuIzjzvwqdLCF294=", "X-MC-Unique": "df0zBZAlNYypCbMWkmGgCQ-1", "X-Mimecast-MFC-AGG-ID": "df0zBZAlNYypCbMWkmGgCQ_1777326757", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1777326757; x=1777931557;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=bPIyKZKTr0zc+cfebuiySCXCgqXc/8QrRE1Ir8djF+4=;\n b=SRqxJN8RHM8M0UNC8XnQkkx+8RbINkDNC0UtnPPvKPVhnW/MoUpNqy7njhCYX0yC0I\n DakKLZMIi5762FRSyBYQVlLVLvseD1Hcl1t6DBsuKq1dT6eU+GMA7PqmJgw2rG/PK59p\n j2bjkngLvzMfPMdtxEwZGerG4ymGJ4ilvGmMzxx7Vb5k/PzIewAlvY/0HlQtCHzO31pG\n /ITr9j5M8Bn8w1bLisJz+OGT4wQB1P+kcGg4JNdVnr+ISH+Rld2sjJKXSf+xbFx8IXry\n F2msYRoYy1lsASue6S3MzxzuiJTMDkqVrc9iXWPMoB1pjcyc6JnxdwQ+wTqZfoJZe1v/\n vvaA==", "X-Gm-Message-State": "AOJu0YzjTfbGngbVa6N3ipiv/R3oTQmu6aLbCIPqyj+GpUcs0mgljqUk\n NUGXAe+f6xXqiAygTXQ6kzHu5ixL82XBtBwkvA25yx9FvNpl5Rc/UX6bWp7Y5gSW7iRakRyUW2U\n keSC5D7//65Sc9xi1Q4OB/kfJvHy7FmMOQnc34XuVWJZVVSIb+jEDpdCiJDDq09TnGEdCZiM+o9\n rsMcIgmJcUMmClF6VpGAZiJdM8XU2OrQXfTHtIoff8tDQ=", "X-Gm-Gg": "AeBDieuqFa4wvgbe1R/syf0finU1RLoQ89ndPEyPFEAXjz3+Y5nXzQYxcsjp3UUuweS\n XqwMMNRo12TfJgnaris+Edgox/1Z2WfYLZ7fxRL4pEhqs+w6aYvZZZgqUDMQOljvud2F+yHozXD\n /3r6Kacg1s55vamhY+yKfoM6k2jdKyky7Ktp1mKhHTZfRMBCoBbsGFhbcN2Mf0N94oiDNqNtcKN\n EnF+0ribnp82jFHIU6vx1/2BheAPDji+soPimZv000s9wt5jN49BglqKA5fRYfqA/X8m+WHNfLv\n wMiRb3kqzSAaviPGzXL4k8BtxIq+fOcZ++1AvWFFDv8MrLGAONwnJaRjZqHTEDKVy/a8JHrqXhU\n Vbb+cZ4gpk1tZ5sWFxxxZekpexX8b4UDABrz+Gwc5TJ7nlW65aDtz9onMH9ei+zNeVfaRjnfCmP\n 06btszY8IcupaILTEJEN7tILwOWnKz5yHnQZxtN0pZlZ3RSUu4lFtAgYix6U+tgg==", "X-Received": [ "by 2002:a05:622a:612:b0:50b:29a6:8696 with SMTP id\n d75a77b69052e-5100e10838emr4805571cf.7.1777326756701;\n Mon, 27 Apr 2026 14:52:36 -0700 (PDT)", "by 2002:a05:622a:612:b0:50b:29a6:8696 with SMTP id\n d75a77b69052e-5100e10838emr4805081cf.7.1777326756084;\n Mon, 27 Apr 2026 14:52:36 -0700 (PDT)" ], "From": "Carlos O'Donell <carlos@redhat.com>", "To": "libc-alpha@sourceware.org,\n\tsiddhesh@gotplt.org", "Cc": "Carlos O'Donell <carlos@redhat.com>", "Subject": "[PATCH] Add advisory text for CVE-2026-5435", "Date": "Mon, 27 Apr 2026 17:52:10 -0400", "Message-ID": "<20260427215230.629899-1-carlos@redhat.com>", "X-Mailer": "git-send-email 2.53.0", "MIME-Version": "1.0", "X-Mimecast-Spam-Score": "0", "X-Mimecast-MFC-PROC-ID": "HYew07HJ5eOnz8tvzGB7oPePxMok0bzatk8xeYGeil8_1777326757", "X-Mimecast-Originator": "redhat.com", "Content-Transfer-Encoding": "8bit", "content-type": "text/plain; charset=\"US-ASCII\"; x-default=true", "X-BeenThere": "libc-alpha@sourceware.org", "X-Mailman-Version": "2.1.30", "Precedence": "list", "List-Id": "Libc-alpha mailing list <libc-alpha.sourceware.org>", "List-Unsubscribe": "<https://sourceware.org/mailman/options/libc-alpha>,\n <mailto:libc-alpha-request@sourceware.org?subject=unsubscribe>", "List-Archive": "<https://sourceware.org/pipermail/libc-alpha/>", "List-Post": "<mailto:libc-alpha@sourceware.org>", "List-Help": "<mailto:libc-alpha-request@sourceware.org?subject=help>", "List-Subscribe": "<https://sourceware.org/mailman/listinfo/libc-alpha>,\n <mailto:libc-alpha-request@sourceware.org?subject=subscribe>", "Errors-To": "libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org" }, "content": "---\n advisories/GLIBC-SA-2026-0011 | 24 ++++++++++++++++++++++++\n 1 file changed, 24 insertions(+)\n create mode 100644 advisories/GLIBC-SA-2026-0011", "diff": "diff --git a/advisories/GLIBC-SA-2026-0011 b/advisories/GLIBC-SA-2026-0011\nnew file mode 100644\nindex 0000000000..6c1e50fa74\n--- /dev/null\n+++ b/advisories/GLIBC-SA-2026-0011\n@@ -0,0 +1,24 @@\n+Potential buffer overflow in ns_sprintrrf TSIG handling path\n+\n+The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the\n+GNU C Library version 2.2 and newer fail to enforce the caller-supplied\n+buffer length, and can result in an out-of-bounds write when printing\n+TSIG records.\n+\n+A defect in the TSIG case handling within ns_sprintrrf performs a\n+formatted write using sprintf without checking the remaining buffer\n+length, and may write up to 6 bytes past the end of the buffer. If the\n+library is compiled with assertions, and the out-of-bounds write doesn't\n+terminate the process, then a subsequent check for \"len <= *buflen\" will\n+trigger an assertion failure.\n+\n+These functions are for debugging only and hence not in the default path\n+of code executed by the DNS resolver. Further, they have been deprecated\n+since version 2.34 (2021-08-02) and should not be used by any new\n+applications. Applications should consider porting away from these\n+interfaces since they may be removed in future versions.\n+\n+CVE-Id: CVE-2026-5435\n+Public-Date: 2026-04-02\n+Vulnerable-Commit: b43b13ac2544b11f35be301d1589b51a8473e32b (2.2)\n+Reported-by: shinobu\n", "prefixes": [] }