HighPublic exploit

glibc getnetbyaddr/getnetbyaddr_r stack information disclosure via zero-valued network DNS query

IdentifiersCVE-2026-0915CWE-200

CVE-2026-0915 is an information disclosure vulnerability in the GNU C Library (glibc) affecting versions 2.0 through 2.42. The flaw is in the DNS-backed networks database lookup path, specifically in _nss_dns_getnetbyaddr_r, which is reached via getnetbyaddr or getnetbyaddr_r when nsswitch.conf is configured to use the DNS NSS backend for the networks database. When these APIs are called with a zero-valued network argument (net == 0x0), glibc can include uninitialized or otherwise unmodified adjacent stack contents in the DNS query sent to the configured resolver. This causes process stack data from the querying host to be disclosed over the network. The issue is documented in GLIBC-SA-2026-0002 and fixed in glibc 2.43.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation results in confidentiality loss through disclosure of adjacent stack contents from the calling process to the configured DNS resolver or to any attacker able to observe traffic between the application and that resolver. The leak is described as spatially limited to nearby stack data, but may still expose sensitive values such as pointers. Disclosure of pointer values could help reduce ASLR entropy and accelerate subsequent exploitation chains. The vulnerability does not by itself provide code execution or privilege escalation.

Mitigation

If you can’t patch tonight, do this now.

Where feasible, avoid using the glibc DNS NSS backend for the networks database in nsswitch.conf; remove or disable dns as a source for networks and prefer non-DNS sources such as files if operationally acceptable. Prevent or minimize calls to getnetbyaddr/getnetbyaddr_r with a zero-valued network argument. Reduce exposure by restricting DNS traffic to trusted resolvers and limiting opportunities for network-adjacent interception or logging of outbound DNS queries.

Remediation

Patch, then assume compromise.

Upgrade glibc to version 2.43 or later, or apply the vendor/distribution backported fix for CVE-2026-0915. The published fix is associated with commit e56ff82d5034ec66c6a78f517af6faa427f65b0b. Validate whether your distribution has shipped patched glibc packages even if the reported package version remains below 2.43 due to backporting.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.

VALID 0 / 1 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

GNU ProjectGlibcapplication

GNU ProjectGnu C Library (Glibc)application

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

50 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

50 SOURCESView more in app

help net securityNews

Mar 2, 2026

IPFire ships its 200th core update with a new domain blocklist and kernel upgrade - Help Net Security

A glibc vulnerability patched in IPFire Core Update 200.

security online infoNews

Jan 19, 2026

Decades-Old Flaw & New Heap Corruption: Critical glibc Bugs Revealed

Information disclosure in glibc getnetbyaddr/getnetbyaddr_r where uninitialized/stack contents may be leaked to a DNS resolver under specific conditions, potentially aiding ASLR bypass.

openwallNews

Jan 25, 2026

oss-security - The GNU C Library security advisories update for 2026-01-16 (part 2)

An information disclosure vulnerability in GNU C Library (glibc) where the DNS NSS backend for network lookups can leak uninitialized/stack contents in DNS queries when getnetbyaddr/getnetbyaddr_r is called with the default network (net == 0x0), potentially aiding ASLR bypass under certain network-adjacent conditions.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity44

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-0915

NVD

nvd.nist.gov/vuln/detail/CVE-2026-0915

MITRE CWE · CWE-200

cwe.mitre.org

Mailing List

openwall.com/lists/oss-security/2026/01/16/6