CVE-2026-4437 gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response
A crafted DNS response can cause glibc to misinterpret non-answer sections, potentially leading to memory corruption and code execution in applications using specific nsswitch configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-4437?
CVE-2026-4437 is a high-severity memory corruption vulnerability in Gnu Glibc, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.
Weakness: CWE-125
Which versions are affected by CVE-2026-4437?
It affects 1 product.
Products include Gnu Glibc.
How do I fix CVE-2026-4437?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-4437 being exploited?
There is no known exploitation of CVE-2026-4437 in the wild and no public exploit code.
Other vulnerabilities in Gnu Glibc
Sources
Also known as AZL-80279, BELL-CVE-2026-4437, DEBIAN-CVE-2026-4437, ECHO-3c7d-5484-9e80, GHSA-m5wq-r4r4-4qrh, MINI-fq6p-vw6g-v37x and 4 more.