REDHAT-BUG-2449777: Medium severity GNU GNU C Library vulnerability

Q: Which applications are exposed to this issue?

Applications using gethostbyaddr or gethostbyaddr_r are affected when nsswitch.conf is configured to use the GNU C Library DNS backend. The issue applies to GNU C Library versions 2.34 through 2.43.

Q: What does an attacker need to exploit it?

An attacker needs to cause the application to receive a crafted response from the DNS server configured for the system. The crafted response causes a non-answer DNS section to be treated as a valid answer.

Published Mar 20, 2026

Updated

Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.

Affected Software

1 affected component

GNU GNU C Library>=2.34<=2.43

Event History

Mar 20, 2026

Data Sourced

via Red Hat·09:02 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using gethostbyaddr or gethostbyaddr_r are affected when nsswitch.conf is configured to use the GNU C Library DNS backend. The issue applies to GNU C Library versions 2.34 through 2.43.

What does an attacker need to exploit it?