CVE-2026-4438

CVE-2026-4438: gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames

Vendor The Gnu C Library

Product glibc

Weakness CWE-20 · Input validation

Published March 20, 2026

Last update March 23, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.

Key dates

02Disclosure timeline

March 20, 2026 CVE published

March 23, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-4438 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/20.html

Related vulnerabilities

CVE-2026-4438: gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames

01Description

02Disclosure timeline

03References

04Related CVE