Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 1 vendor · 1 advisory

CVE-2026-19542

CVE-2026-19542: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Red Hat

1 advisory
  • Advisory severityMedium4.2

    Medium [CVE-2026-19542] Fix out-of-bounds array write in tdelete

    CVE-2026-19542Source published Source updated

    Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not…

    Affected products in this advisory
    • Red Hat Hardened Images
    • Red Hat Enterprise Linux 10
    • Red Hat Enterprise Linux 6
    • Red Hat Enterprise Linux 7

    5 more entries in the full advisory.

    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • glibc-main-2.43-8.2.hum1
    • RHSA-2026:59721
    Mitigation guidance
    • This issue is reachable only through applications that use glibc's tsearch/tdelete APIs and allow construction of extremely deep trees (on the order of a million nodes). Restrict such services to trusted clients and enforce process memory limits so large tree growth is impractical.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future Red Hat CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features