Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| The GNU C Library | glibc | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://sourceware.org/bugzilla/show_bug.cgi?id=34014 |
|
History
Fri, 20 Mar 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer. | |
| Title | gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response | |
| Weaknesses | CWE-125 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: glibc
Published:
Updated: 2026-03-20T19:59:00.427Z
Reserved: 2026-03-19T19:55:42.906Z
Link: CVE-2026-4437
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-20T20:16:49.477
Modified: 2026-03-20T20:16:49.477
Link: CVE-2026-4437
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses