CVE-2026-4438 gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
Attackers can trigger invalid DNS hostname returns in glibc when specific nsswitch.conf configurations are used, potentially causing application errors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-4438?
CVE-2026-4438 is a medium-severity vulnerability in Gnu Glibc, published on 20 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.
Which versions are affected by CVE-2026-4438?
It affects 1 product.
Products include Gnu Glibc.
How do I fix CVE-2026-4438?
Upgrade to a fixed version.
Is CVE-2026-4438 being exploited?
There is no known exploitation of CVE-2026-4438 in the wild and no public exploit code.
Other vulnerabilities in Gnu Glibc
Sources
Also known as AZL-80282, BELL-CVE-2026-4438, DEBIAN-CVE-2026-4438, ECHO-49d5-1f6e-5068, GHSA-935r-rfch-9mr7, MINI-23p3-qw4q-3336 and 4 more.