CVE-2026-4438

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.(CVE-2026-4437)

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.(CVE-2026-4438)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.(CVE-2026-4437)

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.(CVE-2026-4438)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.(CVE-2026-4437)

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.(CVE-2026-4438)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.(CVE-2026-4437)

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.(CVE-2026-4438)

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)

• glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)

• glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)

• glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-4438 in the rootio-glibc package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-4438 in the glibc package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-4438 in the rootio-glibc package for Root:Ubuntu:24.04. Multiple fixed versions available.

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)
• glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)
• glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)
• glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.

• CVE-2026-4437: fix incorrect record counting in getanswer_ptr that allowed iteration past the answer section boundary in DNS responses
• CVE-2026-4438: fix hostname validation checking expected_name instead of name_buffer in getanswer_ptr, which could return invalid hostnames

These are all security issues fixed in the glibc-2.43-1.1 package on the GA media of openSUSE Tumbleweed.

This update for glibc fixes the following issues:

Security fixes:

• CVE-2026-4437: incorrect DNS response parsing via crafted DNS server response (bsc#1260078).
• CVE-2026-4438: invalid DNS hostname returned via gethostbyaddr functions (bsc#1260082).

Other fixes:

• nss: Missing checks in __nss_configure_lookup, __nss_database_get (bsc#1258319).

Root has patched CVE-2026-4438 in the rootio-glibc package for Root:Debian:13. Multiple fixed versions available.

This update for glibc fixes the following issues:

• CVE-2026-4437: incorrect DNS response parsing via crafted DNS server response (bsc#1260078).
• CVE-2026-4438: invalid DNS hostname returned via gethostbyaddr functions (bsc#1260082).

This update for glibc fixes the following issues:

Security fixes:

• CVE-2026-4437: incorrect DNS response parsing via crafted DNS server response (bsc#1260078).
• CVE-2026-4438: invalid DNS hostname returned via gethostbyaddr functions (bsc#1260082).

Other fixes:

• nss: Missing checks in __nss_configure_lookup, __nss_database_get (bsc#1258319).

This update for glibc fixes the following issues:

Security fixes:

• CVE-2026-4437: incorrect DNS response parsing via crafted DNS server response (bsc#1260078).
• CVE-2026-4438: invalid DNS hostname returned via gethostbyaddr functions (bsc#1260082).

Other fixes:

• nss: Missing checks in __nss_configure_lookup, __nss_database_get (bsc#1258319).

This update for glibc fixes the following issues:

• CVE-2026-4437: incorrect DNS response parsing via crafted DNS server response (bsc#1260078).
• CVE-2026-4438: invalid DNS hostname returned via gethostbyaddr functions (bsc#1260082).

This update for glibc fixes the following issues:

• CVE-2026-4437: incorrect DNS response parsing via crafted DNS server response (bsc#1260078).
• CVE-2026-4438: invalid DNS hostname returned via gethostbyaddr functions (bsc#1260082).

This update for glibc fixes the following issues:

Security fixes:

• CVE-2026-4437: incorrect DNS response parsing via crafted DNS server response (bsc#1260078).
• CVE-2026-4438: invalid DNS hostname returned via gethostbyaddr functions (bsc#1260082).

Other fixes:

• nss: Missing checks in __nss_configure_lookup, __nss_database_get (bsc#1258319).

It was discovered that the GNU C Library iconv function incorrectly handled certain IBM character sets. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-4046)

It was discovered that the GNU C Library DNS functions incorrectly handled certain DNS server responses when using gethostbyaddr or gethostbyaddr_r. An attacker in a privileged network position could possibly use this issue to cause an application to violate DNS specification or obtain incorrect hostname information. This issue only affected Ubuntu 24.04 LTS. (CVE-2026-4437, CVE-2026-4438)

It was discovered that the GNU C Library deprecated debugging functions incorrectly enforced caller-supplied buffer lengths. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-5435)

It was discovered that the GNU C Library scanf family of functions contained a heap buffer overflow when processing certain format specifiers. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-5450)

It was discovered that the GNU C Library ungetwc function incorrectly handled certain character encodings. An attacker could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-5928)

It was discovered that the GNU C Library deprecated debugging functions incorrectly validated DNS response record data. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-6238)