Loading story…
The GNU C Library project disclosed two security flaws in gethostbyaddr() and gethostbyaddr_r() affecting glibc versions 2.34 through 2.43 when the DNS backend is enabled through nsswitch.conf, and shipped fixes in glibc 2.44. According to the published advisories, CVE-2026-4437 can cause crafted DNS replies to treat non-answer sections as valid answers, potentially returning an incorrect hostname and enabling limited reverse-DNS obfuscation, while CVE-2026-4438 may accept invalid DNS hostnames containing shell metacharacters, creating a potential shell-injection risk if an application later passes the hostname to a shell unsafely.
The maintainers said exploitation would require a network-adjacent attacker or a compromised DNS server, and noted that no affected DNS servers or vulnerable applications were known at the time of disclosure. Release notes for glibc 2.44 also tie the update to a third security fix, CVE-2026-4046, in iconv() handling of the IBM1390 and IBM1399 character sets, where malformed conversions could trigger incorrect processing or memory corruption under specific conditions.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The GNU C Library 2.44 release announcement said the release also resolved additional security-relevant bugs beyond the three previously highlighted CVEs, including CVE-2026-6238 in ns_sprintrrf plus stack overflow, heap overflow, pointer guard, stack canary, and invalid free issues. This expanded the publicly disclosed security impact of the 2.44 release.
An oss-security post announced two new GNU C Library security advisories covering glibc 2.34 through 2.43 when the DNS backend is used. The flaws affect gethostbyaddr and gethostbyaddr_r, enabling hostname confusion and potential shell-injection risk under specific conditions.
The release of GNU C Library 2.44 included security fixes for CVE-2026-4437, CVE-2026-4438, and CVE-2026-4046 alongside new functionality and architecture support. The fixed issues included the gethostbyaddr/gethostbyaddr_r flaws and an iconv() issue affecting IBM1390 and IBM1399 conversions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
8 references tracked. Mallory keeps watching after this page renders.
savannah.gnu.org
Open sourceseclists.org
Open sourcesecurity-tracker.debian.org
Open sourcesecurity-tracker.debian.org
Open sourceopenwall.com
Open sourceopennet.ru
Open sourceopennet.me
Open sourcesourceware.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The GNU C Library disclosed multiple security flaws affecting widely deployed versions of `glibc`, including two DNS-related bugs in `gethostbyaddr` and `gethostbyaddr_r` when the DNS backend is used through `nsswitch.conf`. Tracked as **CVE-2026-4437** and **CVE-2026-4438**, the issues affect versions **2.34 through 2.43** and stem from defects in the `getanswer_ptr` function. One flaw can cause `glibc` to treat a non-answer DNS section as valid and return the wrong hostname, enabling limited reverse-DNS obfuscation for attackers who are network-adjacent or control the DNS server. The other can return invalid DNS hostnames, including names containing shell metacharacters, creating a potential shell-injection path in applications that unsafely pass resolved hostnames to a shell.
Jun 29, 2026
The GNU C Library project disclosed **`CVE-2025-4802`**, a local privilege-escalation flaw affecting glibc versions **2.27 through 2.38**. The bug causes statically linked **setuid/setgid** ELF binaries that call `dlopen()`—directly or indirectly through functions such as `setlocale`, `getaddrinfo`, or other NSS-related paths—to incorrectly honor **`LD_LIBRARY_PATH`** in secure execution mode, allowing attacker-controlled libraries to be loaded and executed with elevated privileges. Upstream tracked the issue in advisory **`GLIBC-SA-2025-0002`**, describing it as locally exploitable and dependent on the presence of a privileged static binary that invokes dynamic loading. Technical analysis traced the flaw to a 2017 glibc change that removed trusted-path enforcement during runtime path initialization, while the fix moved secure-mode environment sanitization earlier in `_dl_non_dynamic_init()` so variables such as **`LD_LIBRARY_PATH`** are cleared before library search paths are built; the correction landed upstream in **glibc 2.39**. Public writeups and mailing-list discussion included proof-of-concept exploitation using malicious **NSS** modules to achieve code execution as **root** or with **SGID** privileges, but both the advisory and follow-on analysis said practical exposure appears limited because no default-distribution binaries meeting the exploit conditions had been identified, though custom privileged programs remain at risk.
Aug 20, 2026
Red Hat released **Important** glibc security updates for Red Hat Enterprise Linux 7, 8, and 9—including extended, advanced-update, and extended-lifecycle support channels—to remediate `CVE-2024-2961`. The flaw affects the `ISO-2022-CN-EXT` `iconv` conversion module: incomplete internal-buffer checks for SS2 and SS3 charset-switch escape sequences during UCS-4 conversion can write one to three bytes beyond the intended buffer. Red Hat assigned the issue a CVSS v3.1 score of 8.8; successful exploitation may cause memory corruption, denial of service, privilege escalation, or remote code execution depending on the calling application and conditions. The updates also resolve four glibc/nscd netgroup-cache vulnerabilities, including a stack-based buffer overflow, null-pointer dereferences, allocation-failure daemon termination, and unsafe handling of NSS callback strings. Administrators should deploy the updated glibc packages across affected x86_64, ARM64/aarch64, IBM Z/s390x, and IBM Power architectures, then restart all glibc-linked services or reboot hosts. Where patching cannot be performed immediately, Red Hat recommends disabling the vulnerable `ISO-2022-CN-EXT` gconv module and rebuilding the `iconv` cache; fixes were also issued for OpenShift Container Platform 4.12 through 4.16.
Aug 27, 2026