CVE-2026-8674: Assertion failure in the DNS stub resolver with a long search domain
Assertion failure in the DNS stub resolver with a long search domain
Other sources
Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.
The resolver truncates the search list when copying it into the fixed-size res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Which systems and processes are realistically exposed?
Systems using GNU C Library versions 2.26 through 2.44 are affected when their resolver configuration includes a search-domain entry of roughly 200 characters or more. Any process that resolves names through the library can abort, including long-running processes that reload /etc/resolv.conf after it changes.
What does an attacker need to exploit this?
An attacker needs a way to cause the target to use a resolver search list containing an overly long domain. This may be possible from a local network through DHCP or from a VPN server, depending on whether the target's network configuration software validates received resolver settings.
Is administrator access on the target required?
Not necessarily. The issue can be triggered through /etc/resolv.conf data received via DHCP or a VPN server, so an attacker on the local network may be able to cause the condition without privileges on the target system.
How can I determine whether a system is currently at risk?
Check whether the system uses GNU C Library 2.26 through 2.44 and whether /etc/resolv.conf or the LOCALDOMAIN environment variable supplies a search-list domain of roughly 200 characters or more. Processes that perform DNS resolution after such configuration is initialized or reloaded may abort.