Input validation error in GNU C Library (glibc) - CVE-2026-4438

Vulnerability identifier: #VU124258

CSH Severity: Low

CVSS v4 BT: 0.5 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2026-4438

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation when calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library. A remote attacker can force the library to violate the DNS specification and retrieve an invalid DNS hostname to the caller, leading to a potential spoofing attack.

GNU C Library (glibc)
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Basesystem Module
Development Tools Module
openSUSE Leap
Anolis OS
openEuler
glibc-doc
compat-libpthread-nonshared
glibc
glibc-all-langpacks
glibc-benchtests
glibc-common
glibc-devel
glibc-gconv-extra
glibc-langpack-en
glibc-langpack-zh
glibc-minimal-langpack
glibc-locale-source
nss_hesiod
nss_db
libnsl
glibc-utils
glibc-static
glibc-nss-devel
nscd
nss_modules
glibc-help
glibc-debuginfo
glibc-debugsource
glibc-debugutils
glibc-locale-archive
glibc-utils-32bit-debuginfo
glibc-devel-static-32bit
glibc-profile-64bit
glibc-64bit-debuginfo
glibc-devel-64bit
libnsl1-64bit-debuginfo
glibc-locale-base-64bit-debuginfo
glibc-utils-64bit-debuginfo
glibc-locale-base-64bit
glibc-devel-static-64bit
glibc-devel-64bit-debuginfo
glibc-64bit
libnsl1-64bit
glibc-utils-64bit
glibc-profile-32bit
glibc-profile
glibc-devel-static
glibc-utils-src-debugsource
glibc-utils-debuginfo
glibc-32bit-debuginfo
glibc-devel-32bit
glibc-devel-32bit-debuginfo
libnsl1-debuginfo
glibc-extra
glibc-extra-debuginfo
glibc-locale-base
libnsl1
nscd-debuginfo
glibc-locale-base-debuginfo
glibc-locale
glibc-devel-debuginfo
glibc-info
glibc-i18ndata
glibc-lang
libnsl1-32bit-debuginfo
libnsl1-32bit
glibc-locale-base-32bit
glibc-locale-base-32bit-debuginfo
glibc-32bit
glibc-html
glibc-utils-32bit

Install updates from vendor's website.

glibc-doc - update to 2.38-20
compat-libpthread-nonshared - update to 2.38-20
glibc - update to 2.38-20
glibc-all-langpacks - update to 2.38-20
glibc-benchtests - update to 2.38-20
glibc-common - update to 2.38-20
glibc-devel - update to 2.38-20
glibc-gconv-extra - update to 2.38-20
glibc-langpack-en - update to 2.38-20
glibc-langpack-zh - update to 2.38-20
glibc-minimal-langpack - update to 2.38-20
glibc-locale-source - update to 2.38-20
nss_hesiod - update to 2.38-20
nss_db - update to 2.38-20
libnsl - update to 2.38-20
glibc-utils - update to 2.38-20
glibc-static - update to 2.38-20
glibc-nss-devel - update to 2.38-20
libnsl - update to 2.38-98
nscd - update to 2.38-98
nss_modules - update to 2.38-98
glibc-help - update to 2.38-98
glibc - update to 2.38-98
glibc-all-langpacks - update to 2.38-98
glibc-common - update to 2.38-98
glibc-debuginfo - update to 2.38-98
glibc-debugsource - update to 2.38-98
glibc-debugutils - update to 2.38-98
glibc-devel - update to 2.38-98
glibc-locale-archive - update to 2.38-98
glibc-locale-source - update to 2.38-98
glibc-nss-devel - update to 2.38-98
glibc-utils-32bit-debuginfo - update to 2.38-150600.14.46.1
glibc-devel-static-32bit - update to 2.38-150600.14.46.1
glibc-profile-64bit - update to 2.38-150600.14.46.1
glibc-64bit-debuginfo - update to 2.38-150600.14.46.1
glibc-devel-64bit - update to 2.38-150600.14.46.1
libnsl1-64bit-debuginfo - update to 2.38-150600.14.46.1
glibc-locale-base-64bit-debuginfo - update to 2.38-150600.14.46.1
glibc-utils-64bit-debuginfo - update to 2.38-150600.14.46.1
glibc-locale-base-64bit - update to 2.38-150600.14.46.1
glibc-devel-static-64bit - update to 2.38-150600.14.46.1
glibc-devel-64bit-debuginfo - update to 2.38-150600.14.46.1
glibc-64bit - update to 2.38-150600.14.46.1
libnsl1-64bit - update to 2.38-150600.14.46.1
glibc-utils-64bit - update to 2.38-150600.14.46.1
glibc-profile-32bit - update to 2.38-150600.14.46.1
glibc-profile - update to 2.38-150600.14.46.1
glibc-devel-static - update to 2.38-150600.14.46.1
glibc-debuginfo - update to 2.38-150600.14.46.1
glibc-utils-src-debugsource - update to 2.38-150600.14.46.1
glibc-debugsource - update to 2.38-150600.14.46.1
glibc-utils-debuginfo - update to 2.38-150600.14.46.1
glibc-32bit-debuginfo - update to 2.38-150600.14.46.1
glibc-devel-32bit - update to 2.38-150600.14.46.1
glibc-devel-32bit-debuginfo - update to 2.38-150600.14.46.1
libnsl1-debuginfo - update to 2.38-150600.14.46.1
glibc - update to 2.38-150600.14.46.1
glibc-extra - update to 2.38-150600.14.46.1
nscd - update to 2.38-150600.14.46.1
glibc-extra-debuginfo - update to 2.38-150600.14.46.1
glibc-locale-base - update to 2.38-150600.14.46.1
glibc-devel - update to 2.38-150600.14.46.1
glibc-utils - update to 2.38-150600.14.46.1
libnsl1 - update to 2.38-150600.14.46.1
nscd-debuginfo - update to 2.38-150600.14.46.1
glibc-locale-base-debuginfo - update to 2.38-150600.14.46.1
glibc-locale - update to 2.38-150600.14.46.1
glibc-devel-debuginfo - update to 2.38-150600.14.46.1
glibc-info - update to 2.38-150600.14.46.1
glibc-i18ndata - update to 2.38-150600.14.46.1
glibc-lang - update to 2.38-150600.14.46.1
libnsl1-32bit-debuginfo - update to 2.38-150600.14.46.1
libnsl1-32bit - update to 2.38-150600.14.46.1
glibc-locale-base-32bit - update to 2.38-150600.14.46.1
glibc-locale-base-32bit-debuginfo - update to 2.38-150600.14.46.1
glibc-32bit - update to 2.38-150600.14.46.1
glibc-html - update to 2.38-150600.14.46.1
glibc-utils-32bit - update to 2.38-150600.14.46.1

• https://sourceware.org/bugzilla/show_bug.cgi?id=34015

• Spoofing attack in GNU C Library
• openEuler 24.03 LTS SP3 update for glibc
• openEuler 24.03 LTS SP2 update for glibc
• openEuler 24.03 LTS SP1 update for glibc
• openEuler 24.03 LTS update for glibc
• SUSE update for glibc
• Anolis OS update for glibc