CVE-2026-4438: gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.
Other sources
gethostbyaddr and gethostbyaddrr return invalid DNS hostnames
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/glibcto a version that resolves this vulnerability.Fixed in 2.31-13+deb11u11Fixed in 2.31-13+deb11u14Fixed in 2.36-9+deb12u14Fixed in 2.41-12+deb13u3Fixed in 2.42-17 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.38-19
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4438?
The severity of CVE-2026-4438 is classified as medium due to the potential for invalid DNS hostnames being returned.
How do I fix CVE-2026-4438?
To fix CVE-2026-4438, upgrade the GNU C Library from version 2.34 to a version later than 2.43.
What systems are affected by CVE-2026-4438?
CVE-2026-4438 affects systems running GNU C Library versions between 2.34 and 2.43 that utilize the DNS backend.
What functions are involved in CVE-2026-4438?
CVE-2026-4438 involves the functions gethostbyaddr and gethostbyaddr_r within the GNU C Library.
What types of issues could occur due to CVE-2026-4438?
Due to CVE-2026-4438, applications may receive invalid DNS hostnames, potentially leading to connectivity issues.