CVE-2026-4438

medium

Description

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.

References

https://www.helpnetsecurity.com/2026/05/18/debian-13-5-released/

https://sourceware.org/bugzilla/show_bug.cgi?id=34015

Details

Source: Mitre, NVD

Published: 2026-03-20

Updated: 2026-04-07

Risk Information

CVSS v2

Base Score: 4.8

Vector: CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 5.4

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Severity: Medium

EPSS

EPSS: 0.00037