Improper DNS Resolution in GNU C Library Affects Multiple Versions
CVE-2026-4438

5.4MEDIUM

Key Information:

Vendor

The Gnu C Library

Status
Glibc
Vendor
CVE Published:
20 March 2026

What is CVE-2026-4438?

An issue has been identified in the GNU C Library where the functions gethostbyaddr or gethostbyaddr_r may return an invalid DNS hostname due to a misconfiguration in the nsswitch.conf file. This issue can occur when the DNS backend is specified, leading to responses that do not comply with DNS specifications. Consequently, applications relying on accurate DNS resolution can receive erroneous hostnames, potentially compromising network functionality and security.

Affected Version(s)

glibc 2.34 <= 2.43

References

https://sourceware.org/bugzilla/show_bug.cgi?id=34015

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Antonio Maini (0rbitingZer0) - 0rbitingZer0@proton.me
.