[glibc] advisories: Reject GLIBC-SA-2026-0008

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=969cc1df8f467ce3367149628da426692c774083

commit 969cc1df8f467ce3367149628da426692c774083
Author: Carlos O'Donell <[email protected]>
Date:   Tue Apr 21 12:17:02 2026 -0400

    advisories: Reject GLIBC-SA-2026-0008
    
    Reviewed-by: Siddhesh Poyarekar <[email protected]>

Diff:
---
 advisories/GLIBC-SA-2026-0008 | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/advisories/GLIBC-SA-2026-0008 b/advisories/GLIBC-SA-2026-0008
index 1dbd9808e0..43b38ce38a 100644
--- a/advisories/GLIBC-SA-2026-0008
+++ b/advisories/GLIBC-SA-2026-0008
@@ -1,16 +1,22 @@
-Static buffer overflow in deprecated nis_local_principal
+REJECTED: Static buffer overflow in deprecated nis_local_principal
 
-The obsolete nis_local_principal function in the GNU C Library version
-2.43 and older may overflow a buffer in the data section, which could
-allow an attacker to spoof a crafted response to a UDP request generated
-by this function and overwrite neighboring static data in the requesting
-application.
+REJECTED: CVE-2026-5358 is rejected for two reasons. Firstly it has been
+discovered that no NIS+ client or server was ever released for any
+Linux-based OS distributions and as such this makes the API provisional
+and unused.  Secondly it has been discovered that the NIS+ cold start
+cache (/var/nis/NIS_COLD_START) cannot be bypassed and as such the API
+can only be called with a trusted server from the pre-populated cache.
+The use of a trusted server means no trust boundary is crossed and this
+is therefore considered a normal bug.
 
-NIS support is obsolete and has been deprecated in the GNU C Library
-since version 2.26 and is only maintained for legacy usage. Applications
-should port away from NIS to more modern identity and access management
-services.
+NIS+ support in the GNU C Library was never officially supported even
+though an incomplete implementation of the APIs was made pulibc.  To the
+best knowledge of the glibc security team no open-source NIS+ server
+implementations were ever released for use with this API.  Applications
+should not use any of the NIS+ APIs and should move to modern identity
+and access management services.
 
 CVE-Id: CVE-2026-5358
 Public-Date: 2026-04-10
+Rejected-Date: 2026-04-33
 Reported-by: Rahul Hoysala