{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-3904 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-3904 is a medium-severity vulnerability in Gnu Glibc, published on 11 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-3904 and fix it if it is affected.\n\nWhat it is: CVE-2026-3904 is a medium-severity vulnerability in Gnu Glibc, published on 11 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-3904 in the wild and no public exploit code.\n\nAffected product: Gnu Glibc. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-3904/ (Markdown: https://insights.sbomify.com/CVE-2026-3904/index.md)","id":"CVE-2026-3904","markdown":"https://insights.sbomify.com/CVE-2026-3904/index.md","name":"CVE-2026-3904","record":{"aliases":["DEBIAN-CVE-2026-3904","GHSA-3584-5r39-4gm3"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"GNU C Library","requires_auth":"none","summary":"A race condition in the glibc nscd client can cause application crashes on x86_64 systems under high load due to unsafe concurrent memory access.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"glibc","cpe":[{"product":"glibc","vendor":"gnu"}],"cvss":{"score":6.2,"severity":"medium","source":"cisa-adp","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-366","name":"Race Condition within a Thread"}],"description":"Calling NSS-backed functions that support caching via nscd may call the \nnscd client side code and in the GNU C Library version 2.36 under high \nload on x86_64 systems, the client may call memcmp on inputs that are \nconcurrently modified by other processes or threads and crash.\n\nThe nscd client in the GNU C Library uses the memcmp function with \ninputs that may be concurrently modified by another thread, potentially \nresulting in spurious cache misses, which in itself is not a security \nissue.  However in the GNU C Library version 2.36 an optimized \nimplementation of memcmp was introduced for x86_64 which could crash \nwhen invoked with such undefined behaviour, turning this into a \npotential crash of the nscd client and the application that uses it. \nThis implementation was backported to the 2.35 branch, making the nscd \nclient in that branch vulnerable as well.  Subsequently, the fix for \nthis issue was backported to all vulnerable branches in the GNU C \nLibrary repository.\n\nIt is advised that distributions that may have cherry-picked the memcpy \nSSE2 optimization in their copy of the GNU C Library, also apply the fix \nto avoid the potential crash in the nscd client.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Race condition in glibc","id":"CVE-2026-3904","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"gnu:glibc","products":["gnu:glibc"],"type":"race_condition","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API","id":"CVE-2026-3906"},"packages":[],"prev":{"headline":"Modular Connector \u003c= 2.5.1 - Cross-Site Request Forgery via postConfirmOauth","id":"CVE-2026-3903"},"products":["glibc"],"published":"2026-03-11","related":[{"cvss_score":9.8,"headline":"scanf %mc off-by-one heap buffer overflow","id":"CVE-2026-5450","kev_date_added":null,"published":"2026-04-20"},{"cvss_score":9.8,"headline":"Memory corruption in n/a","id":"CVE-2023-25139","kev_date_added":null,"published":"2023-02-03"},{"cvss_score":9.8,"headline":"Other in n/a","id":"CVE-1999-0199","kev_date_added":null,"published":"2020-10-06"},{"cvss_score":9.8,"headline":"Security feature bypass in glibc","id":"CVE-2019-1010022","kev_date_added":null,"published":"2019-07-15"},{"cvss_score":9.8,"headline":"Memory corruption in n/a","id":"CVE-2005-3590","kev_date_added":null,"published":"2019-04-10"},{"cvss_score":9.8,"headline":"Memory corruption in n/a","id":"CVE-2017-18269","kev_date_added":null,"published":"2018-05-18"},{"cvss_score":9.8,"headline":"Integer overflow in n/a","id":"CVE-2018-11236","kev_date_added":null,"published":"2018-05-18"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-15","vendors":["The GNU C Library"]},"summary":"A race condition in the glibc nscd client can cause application crashes on x86_64 systems under high load due to unsafe concurrent memory access.","url":"https://insights.sbomify.com/CVE-2026-3904/"}