CVE-2026-4437

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://sourceware.org/bugzilla/show_bug.cgi?id=34014	Exploit Issue Tracking Patch
https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*

History

14 Jul 2026, 13:18

Type	Values Removed	Values Added
References		() https://cert-portal.siemens.com/productcert/html/ssa-082556.html -

07 Apr 2026, 18:41

Type	Values Removed	Values Added
References	~~() https://sourceware.org/bugzilla/show_bug.cgi?id=34014 -~~	() https://sourceware.org/bugzilla/show_bug.cgi?id=34014 - Exploit, Issue Tracking, Patch
Summary		(es) Llamar a gethostbyaddr o gethostbyaddr_r con un nsswitch.conf configurado que especifica el backend DNS de la biblioteca en la GNU C Library versión 2.34 a la versión 2.43 podría, con una respuesta manipulada del servidor DNS configurado, resultar en una violación de la especificación DNS que hace que la aplicación trate una sección que no es de respuesta de la respuesta DNS como una respuesta válida.
First Time		Gnu Gnu glibc
CPE		cpe:2.3:a:gnu:glibc::::::::

23 Mar 2026, 16:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5

20 Mar 2026, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-20 20:16

Updated : 2026-07-14 13:18

NVD link : CVE-2026-4437

Mitre link : CVE-2026-4437

CVE.ORG link : CVE-2026-4437

JSON object : View

Products Affected

gnu

glibc

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-4437", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4437", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T15:10:34.650805Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "3ff69d7a-14f2-4f67-a097-88dee7810d18", "affectedData": [{"vendor": "The GNU C Library", "product": "glibc", "versions": [{"status": "affected", "version": "2.34", "versionType": "custom", "lessThanOrEqual": "2.43"}], "defaultStatus": "unaffected"}]}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "affectedData": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "V3.1.6", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "V3.1.6", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "V3.1.6", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "V3.1.6", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "V3.1.6", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2026-03-20T20:16:49.477", "references": [{"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34014", "tags": ["Exploit", "Issue Tracking", "Patch"], "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer."}, {"lang": "es", "value": "Llamar a gethostbyaddr o gethostbyaddr_r con un nsswitch.conf configurado que especifica el backend DNS de la biblioteca en la GNU C Library versi\u00f3n 2.34 a la versi\u00f3n 2.43 podr\u00eda, con una respuesta manipulada del servidor DNS configurado, resultar en una violaci\u00f3n de la especificaci\u00f3n DNS que hace que la aplicaci\u00f3n trate una secci\u00f3n que no es de respuesta de la respuesta DNS como una respuesta v\u00e1lida."}], "lastModified": "2026-07-14T13:18:57.923", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1ECF98C3-1D14-492E-9FE0-241B03BF8550", "versionEndIncluding": "2.43", "versionStartIncluding": "2.34"}], "operator": "OR"}]}], "sourceIdentifier": "3ff69d7a-14f2-4f67-a097-88dee7810d18"}