CVE-2026-4437: GNU glibc DNS specification violation in gethostbyaddr

CVE-2026-4437 · Severity: high · CVSS 7.5 · Published 2026-03-20

A vulnerability in the GNU C Library (glibc), a fundamental component of most Linux-based systems, could allow a malicious DNS server to provide misleading information to applications. By sending a specially crafted response, an attacker could cause an application to misidentify a computer's hostname or treat invalid data as a legitimate answer. This could be used to bypass security filters or complicate the investigation of network threats, though it primarily impacts the reliability of system logging and identification.

Technologies: Gnu Glibc, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Gnu, Siemens.

Quick answers

Is CVE-2026-4437 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-4437 being exploited in the wild.
How severe is CVE-2026-4437?
High severity, with a CVSS score of 7.5, published 20 March 2026.
Which products and versions are affected?
Gnu Glibc 2.34 to 2.43; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to V3.1.6.
Is there a fix for CVE-2026-4437?
A patch was published on 2026-03-30: Fix committed to glibc main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4437 attacked?
It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-4437?
Check whether you run Gnu Glibc or Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A defect exists in the getanswer_ptr function within glibc's nss_dns backend (resolv/nss_dns/dns-host.c). When processing a DNS response via gethostbyaddr or gethostbyaddr_r, the library may fail to correctly respect the boundary of the 'answer' section if it contains only skipped records followed by a semantically invalid T_PTR record in a subsequent section. This out-of-bounds read/logic error causes the resolver to treat the subsequent section as a valid answer, violating the DNS specification. An attacker with control over a DNS server or the ability to intercept DNS traffic could exploit this to return incorrect hostnames to an application, potentially facilitating security bypasses or obfuscating malicious activity. The issue is fixed in glibc version 2.44 and patched in various vendor distributions.

Affected products

  • GNU glibc 2.34 to 2.43
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to V3.1.6

Timeline

  • 2026-03-20: disclosed: Vulnerability reported to glibc security team
  • 2026-03-20: advisory: Initial CVE publication
  • 2026-03-30: patched: Fix committed to glibc main branch
  • 2026-07-14: other: Siemens updated advisory to include affected industrial controllers

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.