[PATCH] Add advisory text for CVE-2026-5435

Florian Weimer fweimer@redhat.com
Tue Apr 28 04:47:35 GMT 2026


* Carlos O'Donell:

> +These functions are for debugging only and hence not in the default path
> +of code executed by the DNS resolver. Further, they have been deprecated
> +since version 2.34 (2021-08-02) and should not be used by any new
> +applications. Applications should consider porting away from these
> +interfaces since they may be removed in future versions.

Drop the “default”, maybe say “application debugging”?  The proposed
wording makes it sound like it's configurable to be on the execution
path, which is I believe not the case.

Thanks,
Florian



More information about the Libc-alpha mailing list