Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.

Multiple Vulnerabilities in GNOME GLib

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500006 advisory.

    - resolv: Check hostname for validity (CVE-2026-4438)
    - resolv: Count records correctly (CVE-2026-4437)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19061 advisory.

    - resolv: Check hostname for validity (CVE-2026-4438)
    - resolv: Count records correctly (CVE-2026-4437)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1259:07 advisory.

    * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)
      * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)
      * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:20597 advisory.

    * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)
      * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)
      * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has     overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or     earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in     unintentional disclosure of neighboring data in the heap, or a program crash._x000D_
    _x000D_     A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes     ungetwc() to operate on the regular character buffer (fp-_IO_read_ptr) instead of the actual wide-     stream read pointer (fp-_wide_data-_IO_read_ptr). The program crash may happen in cases where fp-
    _IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special     situation where the input character encoding is such that there are overlaps between single byte     representations and multibyte representations in that encoding, resulting in spurious matches. The     spurious match case is not possible in the standard Unicode character sets.(CVE-2026-5928)

    Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version     2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in     a one byte heap buffer overflow.(CVE-2026-5450)

    The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure     when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an     application._x000D_
    _x000D_
    _x000D_
    _x000D_     This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from     systems that do not need them.(CVE-2026-4046)

    Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS     backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the     configured DNS server, result in a violation of the DNS specification that causes the application to treat     a non-answer section of the DNS response as a valid answer.(CVE-2026-4437)

    Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS     backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being     returned to the caller in violation of the DNS specification.(CVE-2026-4438)

Tenable has extracted the preceding description block directly from the EulerOS glibc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-20597 advisory.

    [2.34-270.0.1]
    - Forward-port Oracle patches for ol9-u8       Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       Oracle history:
      May-20-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-266.0.1
      - Forward-port Oracle patches for ol9-u8         Reviewed-by: David Faust <david.faust@oracle.com>       March-25-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-262.0.1
      - Forward-port Oracle patches for ol9-u8         Reviewed-by: David Faust <david.faust@oracle.com>       March-6-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-256.0.1
      - Forward-port Oracle patches for ol9-u8         Reviewed-by: David Faust <david.faust@oracle.com>       February-3-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-245.0.1
      - Forward-port Oracle patches for ol9-u8         Reviewed-by: David Faust <david.faust@oracle.com>       November-14-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1.1
      - Forward-port Oracle patches for ol9-u7         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       September-24-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1
      - Forward-port Oracle patches for ol9-u7         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       September-8-2025 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-228.0.1
      - Forward-port Oracle patches for ol9-u7         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-217.0.1
      - Forward-port Oralce patches for ol9-u7         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.23
      - Forward-port Oracle patches for ol9-u6         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       June-30-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.20
      - Forward-port Oracle patches for ol9-u6         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.19
      - Forward-port Oracle patches for ol9-u6         Reviewed-by: David Faust <david.faust@oracle.com>       May-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.14
      - Forward-port Oracle patches for ol9-u6         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-6-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1
      - Forward-port Oracle patches for ol9-u6         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       February-18-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-160.0.1
      - Forward-port Oracle patches for ol9-u6 DP         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       November-12-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-125.0.1.1
      - Forward-port Oracle patches for ol9-u5         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       October-1-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.4
      - Forward-port Oracle patches for ol9-u4         Reviewed by: David Faust <david.faust@oracle.com>       August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-100.0.1.3
      - Forward-port Oracle patches for ol9-u4         Reviewed by: David Faust <david.faust@oracle.com>       May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.2
      - Forward-port Oracle patches for ol9-u4         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-30-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1
      - Forward-port Oracle patches for ol9-u4         Reviewed by: Indu Bhagat <indu.bhagat@oracle.com>       March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1
      - Forward-port Oracle patches for ol9-u4-beta         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       March 15 2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.12
      - Forward-port Oracle patches for ol9         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       February-26-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.7
      - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       October-24-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.1.7
      - Forward-port Oracle patches for ol9         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-82.0.1
      - Forward-port Oracle patches for ol9         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-18-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.2
      - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks
      - Created tunable glibc.pthread.stack_hugetlb to control when hugepages         can be used for stack allocation.
      - In case THP are enabled and glibc.pthread.stack_hugetlb is set to         0, glibc will madvise the kernel not to use allow hugepages for stack         allocations.
        Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.1
      - Merge Oracle patches for ol9-u2 beta         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-40.0.1
      - Merge Oracle patches for ol9-u1 beta         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-25-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-28.0.1
      - Merge Oracle patches with ol9 beta
      - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

    [2.34-270]
    - Fix incorrect setting of CXX variable in spec file (RHEL-148252)

    [2.34-269]
    - Fix __nss_get_default_domain logic to restore netgroup user enumeration       (RHEL-168096)

    [2.34-268]
    - resolv: Correctly count records and check hostname validity (RHEL-168851,       RHEL-168852)

    [2.34-267]
    - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules       (RHEL-162901)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:20597 advisory.

    * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)

    * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)

    * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19061 advisory.

    * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)

    * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-726:04 advisory.

    * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:20597 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)

    * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)

    * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:19061 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)

    * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1369-1 advisory.

    - CVE-2026-4437: incorrect DNS response parsing via crafted DNS server response (bsc#1260078).
    - CVE-2026-4438: invalid DNS hostname returned via gethostbyaddr functions (bsc#1260082).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the glibc package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS     backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being     returned to the caller in violation of the DNS specification. (CVE-2026-4438)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
327344	Oracle Linux 10 : glibc (ELSA-2026-500006)	Nessus	Oracle Linux Local Security Checks	medium
327068	Oracle Linux 10 : glibc (ELSA-2026-19061)	Nessus	Oracle Linux Local Security Checks	medium
326754	MiracleLinux 9 : glibc-2.34-270.el9_8 (AXSA:2026-1259:07)	Nessus	Miracle Linux Local Security Checks	medium
323956	AlmaLinux 9 : glibc (ALSA-2026:20597)	Nessus	Alma Linux Local Security Checks	medium
323210	EulerOS 2.0 SP15 : glibc (EulerOS-SA-2026-2483)	Nessus	Huawei Local Security Checks	critical
323171	EulerOS 2.0 SP15 : glibc (EulerOS-SA-2026-2442)	Nessus	Huawei Local Security Checks	critical
322986	Oracle Linux 9 : glibc (ELSA-2026-20597)	Nessus	Oracle Linux Local Security Checks	medium
318034	RockyLinux 9 : glibc (RLSA-2026:20597)	Nessus	Rocky Linux Local Security Checks	medium
317963	RockyLinux 10 : glibc (RLSA-2026:19061)	Nessus	Rocky Linux Local Security Checks	medium
317384	MiracleLinux 8 : glibc-2.28-251.el8_10.37 (AXSA:2026-726:04)	Nessus	Miracle Linux Local Security Checks	medium
316898	RHEL 9 : glibc (RHSA-2026:20597)	Nessus	Red Hat Local Security Checks	medium
315399	RHEL 10 : glibc (RHSA-2026:19061)	Nessus	Red Hat Local Security Checks	medium
306682	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : glibc (SUSE-SU-2026:1369-1)	Nessus	SuSE Local Security Checks	medium
305122	Photon OS 5.0: Glibc PHSA-2026-5.0-0802	Nessus	PhotonOS Local Security Checks	medium
303236	Linux Distros Unpatched Vulnerability : CVE-2026-4438	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-4438

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium