Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| The GNU C Library | glibc | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://sourceware.org/bugzilla/show_bug.cgi?id=34015 |
|
History
Fri, 20 Mar 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification. | |
| Title | gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames | |
| Weaknesses | CWE-20 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: glibc
Published:
Updated: 2026-03-20T19:59:06.064Z
Reserved: 2026-03-19T19:55:44.639Z
Link: CVE-2026-4438
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-20T20:16:49.623
Modified: 2026-03-20T20:16:49.623
Link: CVE-2026-4438
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses