Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| The GNU C Library | glibc | unaffected |
|
No data.
No data.
No data.
Subscriptions
No data.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://sourceware.org/bugzilla/show_bug.cgi?id=34014 |
|
History
Fri, 20 Mar 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer. | |
| Title | gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response | |
| Weaknesses | CWE-125 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: glibc
Published:
Updated: 2026-03-20T19:59:00.427Z
Reserved: 2026-03-19T19:55:42.906Z
Link: CVE-2026-4437
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-20T20:16:49.477
Modified: 2026-03-20T20:16:49.477
Link: CVE-2026-4437
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses