Description
Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6Attack Vector: Network
Complexity: Low
Privileges: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None
Affected Packages3 packages
🔴Vulnerability Details
3GHSAGHSA-xp56-6525-9chf: Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch↗2026-01-16 CVEListgetnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler↗2026-01-15 OSVCVE-2026-0915: Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch↗2026-01-15 📋Vendor Advisories
3UbuntuGNU C Library vulnerabilities↗2026-02-03 Red Hatglibc: glibc: Information disclosure via zero-valued network query↗2026-01-15 DebianCVE-2026-0915: glibc - Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that spec...↗2026 🕵️Threat Intelligence
1WizCVE-2026-0915 Impact, Exploitability, and Mitigation Steps | Wiz↗