CVE-2026-6238: Buffer overread in ns_printrrf with corrupted RDATA field
Last updated 30 June 2026
Other sources
The deprecated functions nsprintrrf, nsprintrr and fpnquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.
— Launchpad
The deprecated functions nsprintrrf, nsprintrr and fpnquery in the GNU C Library version 2.2 and newer fail to validate the RDATA content against the RDATA length in a DNS response when processing LOC, CERT, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.
These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Port applications away from deprecated GNU C Library functions ns_printrrf, ns_printrr, and fp_nquery (deprecated since glibc 2.34) since they may be removed in future versions and have buffer overread issues in glibc 2.0.1 through 2.43 (ns_printrrf/ns_printrr/fp_nquery) and in glibc 2.2 and newer (ns_printrrf/ns_printrr/fp_nquery) when processing DNS records (A6, CERT, LOC, TKEY, TSIG).
GNU C Library (glibc) Avoid using deprecated DNS-related functions ns_printrrf, ns_printrr, fp_nquery = Do not use these functions in any new or updated applications
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6238?
The vulnerability CVE-2026-6238 is categorized as a high severity issue due to the potential for buffer overread that could lead to information disclosure.
How do I fix CVE-2026-6238?
To resolve CVE-2026-6238, update the GNU C Library to a version that includes the fix for the buffer overread issue.
Which versions of the GNU C Library are affected by CVE-2026-6238?
CVE-2026-6238 affects the GNU C Library version 2.2 and newer.
What type of records are involved in CVE-2026-6238?
CVE-2026-6238 involves CORRUPT RDATA fields in DNS responses for LOC, CERT, TKEY, and TSIG records.
What are the risks associated with CVE-2026-6238?
The risks associated with CVE-2026-6238 include potential data leakage and exposure of sensitive information due to the buffer overread.