GNU C Library up to 2.43 nsswitch.conf gethostbyaddr_r out-of-bounds

Summaryinfo

A vulnerability marked as problematic has been reported in GNU C Library up to 2.43. Affected by this issue is the function gethostbyaddr_r of the file nsswitch.conf. This manipulation causes out-of-bounds. This vulnerability is handled as CVE-2026-4437. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in GNU C Library up to 2.43 and classified as problematic. Affected by this vulnerability is the function gethostbyaddr_r of the file nsswitch.conf. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality. The summary by CVE is:

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.

It is possible to read the advisory at sourceware.org. This vulnerability is known as CVE-2026-4437 since 03/19/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 303238 (Linux Distros Unpatched Vulnerability : CVE-2026-4437), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (303238), EUVD (EUVD-2026-13796) and CERT Bund (WID-SEC-2026-0817). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Google Container-Optimized OS
• Red Hat Enterprise Linux
• SUSE Linux
• Oracle Linux
• NetApp ActiveIQ Unified Manager
• SUSE openSUSE
• RESF Rocky Linux
• IBM MQ
• Open Source GNU libc

Productinfo

Type

• Software Library

Vendor

• GNU

Name

• C Library

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34
• 2.35
• 2.36
• 2.37
• 2.38
• 2.39
• 2.40
• 2.41
• 2.42
• 2.43

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion