CVE-2026-4438

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.

Score

CVSS 3.1 5.4 Medium

Status

Modified - 3ff69d7a-14f2-4f67-a097-88dee7810d18

Published

2026-03-20

Last modified

2026-10-15

Weaknesses

CWE-20, CWE-88

Affected products

• Glibc (Gnu)
• Simatic S7-1500 Cpu 1518-4 Pndp Mfp (Siemens)
• Simatic S7-1500 Cpu 1518f-4 Pndp Mfp (Siemens)
• Siplus S7-1500 Cpu 1518-4 Pndp Mfp (Siemens)
• Glibc (The Gnu C Library)

References

• https://sourceware.org/bugzilla/show_bug.cgi?id=34015
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html