CVE-2026-4437: gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response
Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.
Other sources
gethostbyaddr and gethostbyaddrr may incorrectly handle DNS response
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/glibcto a version that resolves this vulnerability.Fixed in 2.31-13+deb11u11Fixed in 2.31-13+deb11u14Fixed in 2.36-9+deb12u14Fixed in 2.41-12+deb13u3Fixed in 2.42-17 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.38-19
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4437?
CVE-2026-4437 is classified as a high severity vulnerability due to the potential for denial of service caused by improper handling of DNS responses.
How do I fix CVE-2026-4437?
To fix CVE-2026-4437, update the GNU C Library to a version later than 2.43, ensuring your system is configured correctly to handle DNS responses.
Which versions of the GNU C Library are affected by CVE-2026-4437?
CVE-2026-4437 affects GNU C Library versions from 2.34 up to and including 2.43.
What functions are vulnerable in CVE-2026-4437?
The functions gethostbyaddr and gethostbyaddr_r are the ones that may incorrectly handle DNS responses in CVE-2026-4437.
What conditions trigger CVE-2026-4437?
CVE-2026-4437 is triggered by a crafted response from a DNS server when using a specific configuration in the nsswitch.conf file.