Description
Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5Attack Vector: Adjacent
Complexity: Low
Privileges: None
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None
Affected Packages3 packages
🔴Vulnerability Details
3GHSAGHSA-935r-rfch-9mr7: Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch↗2026-03-20 CVEListgethostbyaddr and gethostbyaddr_r return invalid DNS hostnames↗2026-03-20 OSVCVE-2026-4438: Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch↗2026-03-20 📋Vendor Advisories
3Red Hatglibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions↗2026-03-20 Microsoftgethostbyaddr and gethostbyaddr_r return invalid DNS hostnames↗2026-03-10 DebianCVE-2026-4438: glibc - Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that sp...↗2026 🕵️Threat Intelligence
1WizCVE-2026-4438 Impact, Exploitability, and Mitigation Steps | Wiz↗