CVE-2026-4438Disclosure(gnu / glibc)

LOWCVSS 5.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.

gnu CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://sourceware.org/bugzilla/show_bug.cgi?id=34015

Exploit / PoC references

https://sourceware.org/bugzilla/show_bug.cgi?id=34015

Other references

https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Weakness type (CWE)

CWE-20CWE-88

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

glibc

Threat summary

4 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-03-21); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

gnu

Products

glibc

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

375.0%

General

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-20	1	Disclosure1
2026-03-21	2	Disclosure2
2026-03-24	1	General1

Full discourse4 posts

Open Source Security mailing list@oss_security199d
General
2 CVEs in glibc https://www.openwall.com/lists/oss-security/2026/03/23/2 CVE-2026-4437,GLIBC-SA-2026-0005: gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response CVE-2026-4438,GLIBC-SA-2026-0006: gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
Post summary
The note lists two glibc vulnerabilities and briefly describes their impact, but provides no evidence of PoC, exploit code, active attacks, patches, or error flags.
020722.3K
4.4K followersView on X
Infoflowcloud@infoflowcloud202d
Disclosure
🚨*CVE* CVE-2026-4438 Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 coul… https://www.cve.org/CVERecord?id=CVE-2026-4438 ----- Traducción: CVE-2026-4438 Lla… http://infoflow.cloud`
Post summary
The tweet merely announces CVE-2026-4438 and provides a link to the official CVE record, without sharing detailed technical data, exploits, or mitigations.
0000029
61 followersView on X
CVE@CVEnew202d
Disclosure
CVE-2026-4438 Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 coul… https://www.cve.org/CVERecord?id=CVE-2026-4438
Post summary
A brief disclosure of CVE-2026-4438 describing an issue with gethostbyaddr or gethostbyaddr_r in GNU C library versions 2.34–2.43, with no PoC, patch, or active exploitation details.
00000199
56.8K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash202d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-4438 - gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames Intel Report: https://ift.tt/FQ3IeBE
Post summary
The alert cites CVE‑2026‑4438, highlighting that gethostbyaddr functions return invalid DNS hostnames. No PoC, exploit, patch, or exploitation activity is mentioned.
0000073
334 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	gnu	glibc	-	-	-

Explore more

Back to dashboard gnu CVEs glibc vulnerabilities

What researchers are saying

CVE-2026-4438

Open Source Security mailing list@oss_securityGeneral

The note lists two glibc vulnerabilities and briefly describes their impact, but provides no evidence of PoC, exploit code, active attacks, patches, or error flags.

Infoflowcloud@infoflowcloudDisclosure

The tweet merely announces CVE-2026-4438 and provides a link to the official CVE record, without sharing detailed technical data, exploits, or mitigations.

CVE@CVEnewDisclosure

A brief disclosure of CVE-2026-4438 describing an issue with gethostbyaddr or gethostbyaddr_r in GNU C library versions 2.34–2.43, with no PoC, patch, or active exploitation details.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

The alert cites CVE‑2026‑4438, highlighting that gethostbyaddr functions return invalid DNS hostnames. No PoC, exploit, patch, or exploitation activity is mentioned.