https://seclists.org/oss-sec/2026/q3/817: The GNU C Library security advisories update for 2026-09-17

Q: Which systems and processes are exposed?

GNU C Library versions 2.26 through 2.44 are affected. Any process that resolves names through the library can abort, including long-running processes that reload /etc/resolv.conf after it changes.

Q: What does an attacker need to trigger the failure?

The resolver must be initialized from /etc/resolv.conf or the LOCALDOMAIN environment variable with a search-list domain of roughly 200 characters or more. An attacker on the local network may be able to supply such a search domain through DHCP or a VPN server without privileges on the target, depending on validation performed by the network configuration software.

Q: When would a running service encounter the problem after a configuration change?

Long-running processes that reload /etc/resolv.conf can be affected on their next name-resolution query after the file changes. The result is an assertion failure that aborts the process.

Published Sep 17, 2026

Updated

Affected Software

1 affected component

GNU GNU C Library (glibc)>=2.26<=2.44

Frequently Asked Questions

Which systems and processes are exposed?

GNU C Library versions 2.26 through 2.44 are affected. Any process that resolves names through the library can abort, including long-running processes that reload /etc/resolv.conf after it changes.

What does an attacker need to trigger the failure?

The resolver must be initialized from /etc/resolv.conf or the LOCALDOMAIN environment variable with a search-list domain of roughly 200 characters or more. An attacker on the local network may be able to supply such a search domain through DHCP or a VPN server without privileges on the target, depending on validation performed by the network configuration software.

When would a running service encounter the problem after a configuration change?

Long-running processes that reload /etc/resolv.conf can be affected on their next name-resolution query after the file changes. The result is an assertion failure that aborts the process.