CVE-2026-5358

✕ Withdrawn — historical dataUNRATEDCVSS · not yet scored
—

Rejected reason: REJECTED: CVE-2026-5358 is rejected for two reasons. Firstly it has been discovered that no NIS+ client or server was ever released for any Linux-based OS distributions and as such this makes the API provisional and unused. Secondly it has been discovered that the NIS+ cold start cache (/var/nis/NIS_COLD_START) cannot be bypassed and as such the API can only be called with a trusted server from the pre-populated cache. The use of a trusted server means no trust boundary is crossed and this is therefore considered a normal bug.

CVSS v3
—
EchelonGraph score
Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB
—
EPSS %ILE
—
KEV
—Not applicable: this CVE ID was withdrawn

Published

April 20, 2026

Last Modified

April 22, 2026

Frequently asked(3)

What is CVE-2026-5358?
CVE-2026-5358 is a rejected CVE ID: its record was withdrawn on April 22, 2026 and no longer describes a vulnerability. Reason given: REJECTED: CVE-2026-5358 is rejected for two reasons. Firstly it has been discovered that no NIS+ client or server was ever released for any Linux-based OS distributions and as such this makes the API provisional and unused. Secondly it has been discovered that the NIS+ cold start cache (/var/nis/NIS_COLD_START) cannot be bypassed and as such the API can only be called with a trusted server from the pre-populated cache. The use of a trusted server means no trust boundary is crossed and th…
When was the CVE record for CVE-2026-5358 published?
The CVE record for CVE-2026-5358 was published on April 20, 2026. EchelonGraph's copy of the record carries a last-modified date of April 22, 2026; the record at its source may have been updated since.
How do I remediate CVE-2026-5358?
There is nothing to remediate under CVE-2026-5358: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.