Assertion Failure Vulnerability in GNU C Library DNS Resolver

CVE-2026-8674

What is CVE-2026-8674?

The problem arises when the DNS stub resolver is initialized from an /etc/resolv.conf file or LOCALDOMAIN environment variable containing a lengthy search list of approximately 200 characters or more. This issue affects GNU C Library versions between 2.26 and 2.44, leading to an assertion failure that can cause the process to abort. The DNS resolver attempts to manage the search list but ends up truncating it when copying it into a fixed-size buffer. As a result, a mismatch between the truncated search list and the original configuration is not correctly validated. Consequently, processes dependent on name resolution that refresh their configurations upon receiving updates—such as from DHCP or VPN servers—can be exploited by attackers on the local network, potentially compromising system stability.

References