PT-2026-26671 · Gnu+1 · Gnu C Library+1

CVE-2026-4438 · Published 2026-01-01 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GNU C library versions 2.34 through 2.43

Description The GNU C library’s gethostbyaddr and gethostbyaddr r functions, when used with a configured nsswitch.conf file specifying the library’s DNS backend, may return invalid DNS hostnames. This behavior violates the DNS specification.

Recommendations Update the GNU C library to a version later than 2.43.

Exploit

Fix

RCE

Argument Injection

Weakness Enumeration

CWE-20

CWE-88

Related Identifiers

ALSA-2026:19061

ALSA-2026:20597

CVE-2026-4438

ECHO-49D5-1F6E-5068

OPENSUSE-SU-2026:10662-1

OPENSUSE-SU-2026:20501-1

RHSA-2026:19061

RHSA-2026:20597

RHSA-2026:7316

SUSE-SU-2026:1369-1

SUSE-SU-2026:20999-1

SUSE-SU-2026:21019-1

SUSE-SU-2026:21039-1

SUSE-SU-2026:21069-1

SUSE-SU-2026:21164-1

USN-8611-1

Affected Products

Gnu C Library

Rocky Linux

References · 66

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4438.json · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2026:1369-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:21039-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-4046 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-5435 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2026-4438 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8611-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-4438 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10662-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-19061.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:19061 · Vendor Advisory
• https://sourceware.org/bugzilla/show_bug.cgi?id=34015 · Patch
• https://ubuntu.com/security/notices/USN-8611-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-4438 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-4438 · Vendor Advisory