Loading story…
The GNU C Library disclosed multiple security flaws affecting widely deployed versions of glibc, including two DNS-related bugs in gethostbyaddr and gethostbyaddr_r when the DNS backend is used through nsswitch.conf. Tracked as CVE-2026-4437 and CVE-2026-4438, the issues affect versions 2.34 through 2.43 and stem from defects in the getanswer_ptr function. One flaw can cause glibc to treat a non-answer DNS section as valid and return the wrong hostname, enabling limited reverse-DNS obfuscation for attackers who are network-adjacent or control the DNS server. The other can return invalid DNS hostnames, including names containing shell metacharacters, creating a potential shell-injection path in applications that unsafely pass resolved hostnames to a shell.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-30, the GNU C Library published security advisory GLIBC-SA-2026-0007 describing a denial-of-service vulnerability in iconv() affecting version 2.43 and earlier. The flaw can trigger an assertion failure when converting untrusted input from the IBM1390 or IBM1399 character sets, and glibc noted that removing those character sets is a practical mitigation where they are not needed.
On 2026-03-23, the GNU C Library published two security advisories covering defects in the getanswer_ptr function in glibc 2.34 through 2.43. The advisories said no known DNS server currently returns the malicious responses needed for exploitation and no vulnerable application had been identified for the shell-injection scenario.
The GNU C Library publicly dated two vulnerabilities on 2026-03-20 affecting gethostbyaddr and gethostbyaddr_r when using the DNS backend via nsswitch.conf. CVE-2026-4437 can cause incorrect hostname resolution from malformed DNS responses, and CVE-2026-4438 can return invalid hostnames including shell metacharacters, creating potential shell-injection risk in unsafe applications.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The GNU C Library project disclosed two security flaws in `gethostbyaddr()` and `gethostbyaddr_r()` affecting glibc versions `2.34` through `2.43` when the DNS backend is enabled through `nsswitch.conf`, and shipped fixes in **glibc 2.44**. According to the published advisories, **CVE-2026-4437** can cause crafted DNS replies to treat non-answer sections as valid answers, potentially returning an incorrect hostname and enabling limited reverse-DNS obfuscation, while **CVE-2026-4438** may accept invalid DNS hostnames containing shell metacharacters, creating a potential shell-injection risk if an application later passes the hostname to a shell unsafely. The maintainers said exploitation would require a network-adjacent attacker or a compromised DNS server, and noted that no affected DNS servers or vulnerable applications were known at the time of disclosure. Release notes for **glibc 2.44** also tie the update to a third security fix, **CVE-2026-4046**, in `iconv()` handling of the `IBM1390` and `IBM1399` character sets, where malformed conversions could trigger incorrect processing or memory corruption under specific conditions.
Jul 27, 2026
The GNU C Library project disclosed **`CVE-2025-4802`**, a local privilege-escalation flaw affecting glibc versions **2.27 through 2.38**. The bug causes statically linked **setuid/setgid** ELF binaries that call `dlopen()`—directly or indirectly through functions such as `setlocale`, `getaddrinfo`, or other NSS-related paths—to incorrectly honor **`LD_LIBRARY_PATH`** in secure execution mode, allowing attacker-controlled libraries to be loaded and executed with elevated privileges. Upstream tracked the issue in advisory **`GLIBC-SA-2025-0002`**, describing it as locally exploitable and dependent on the presence of a privileged static binary that invokes dynamic loading. Technical analysis traced the flaw to a 2017 glibc change that removed trusted-path enforcement during runtime path initialization, while the fix moved secure-mode environment sanitization earlier in `_dl_non_dynamic_init()` so variables such as **`LD_LIBRARY_PATH`** are cleared before library search paths are built; the correction landed upstream in **glibc 2.39**. Public writeups and mailing-list discussion included proof-of-concept exploitation using malicious **NSS** modules to achieve code execution as **root** or with **SGID** privileges, but both the advisory and follow-on analysis said practical exposure appears limited because no default-distribution binaries meeting the exploit conditions had been identified, though custom privileged programs remain at risk.
Aug 20, 2026
Red Hat released **Important** glibc security updates for Red Hat Enterprise Linux 7, 8, and 9—including extended, advanced-update, and extended-lifecycle support channels—to remediate `CVE-2024-2961`. The flaw affects the `ISO-2022-CN-EXT` `iconv` conversion module: incomplete internal-buffer checks for SS2 and SS3 charset-switch escape sequences during UCS-4 conversion can write one to three bytes beyond the intended buffer. Red Hat assigned the issue a CVSS v3.1 score of 8.8; successful exploitation may cause memory corruption, denial of service, privilege escalation, or remote code execution depending on the calling application and conditions. The updates also resolve four glibc/nscd netgroup-cache vulnerabilities, including a stack-based buffer overflow, null-pointer dereferences, allocation-failure daemon termination, and unsafe handling of NSS callback strings. Administrators should deploy the updated glibc packages across affected x86_64, ARM64/aarch64, IBM Z/s390x, and IBM Power architectures, then restart all glibc-linked services or reboot hosts. Where patching cannot be performed immediately, Red Hat recommends disabling the vulnerable `ISO-2022-CN-EXT` gconv module and rebuilding the `iconv` cache; fixes were also issued for OpenShift Container Platform 4.12 through 4.16.
Aug 27, 2026