# CVE-2026-4438: GNU glibc improper input validation in gethostbyaddr

Source: https://junglewise.ai/threats/cve-2026-4438-gnu-glibc-improper-input-validation-in-gethostbyaddr  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-20. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-4438 · Severity: medium · CVSS 5.4 · Published 2026-03-20

A vulnerability in a core Linux system library (glibc) could allow an attacker to provide a malicious network name that contains hidden commands. If a program uses this library to look up a computer's name and then passes that name to a command-line script, the attacker could potentially execute unauthorized actions on the system. This risk is primarily present if an attacker has already compromised a local network's DNS server or is positioned to intercept network traffic.

Technologies: [Gnu Glibc](https://junglewise.ai/threats/technologies/glibc), [Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp), [Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518f-4-pn-dp-mfp), [Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/siplus-s7-1500-cpu-1518-4-pn-dp-mfp). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-4438 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4438 being exploited in the wild.

**How severe is CVE-2026-4438?** Medium severity, with a CVSS score of 5.4, published 20 March 2026.

**Which products and versions are affected?** Gnu Glibc 2.34 to 2.43; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to V3.1.6; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5 to V3.1.6; Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to V3.1.6.

**Is there a fix for CVE-2026-4438?** A patch was published on 2026-03-30: Fix committed to glibc repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4438 attacked?** It is attacked from the adjacent network or over the network, in a software library.

**Am I affected by CVE-2026-4438?** Check whether you run Gnu Glibc, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A defect in the getanswer_ptr function within resolv/nss_dns/dns-host.c causes glibc to accept invalid DNS hostnames from PTR records. The root cause is an improper validation check where __res_binary_hnok was called against the 'expected_name' (the query) rather than the 'name_buffer' (the response). An attacker who controls a DNS server or can perform a man-in-the-middle attack could return a hostname containing shell metacharacters. If the calling application subsequently uses this hostname in a shell-executed command without sanitization, it could lead to shell injection. The vulnerability affects glibc versions 2.34 through 2.43 and has been addressed in version 2.44 and subsequent patches.

## Affected products

- GNU glibc 2.34 to 2.43
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to V3.1.6
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5 to V3.1.6
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 to V3.1.6

## Timeline

- 2026-03-20: disclosed: Bug reported to glibc maintainers
- 2026-03-20: advisory: Initial CVE publication
- 2026-03-30: patched: Fix committed to glibc repository
- 2026-07-14: advisory: Siemens updated advisory for SIMATIC S7-1500 products

## References

- [https://sourceware.org/bugzilla/show_bug.cgi?id=34015](https://sourceware.org/bugzilla/show_bug.cgi?id=34015)
- [https://cert-portal.siemens.com/productcert/html/ssa-082556.html](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)

## Related threats

- [Linux Kernel denial of service in IPv6 tunneled traffic handling](https://junglewise.ai/threats/cve-2026-43057-linux-kernel-denial-of-service-in-ipv6-tunneled-traffic-handling)
- [Linux Kernel information leak in IPv6 ndisc nduseroptmsg](https://junglewise.ai/threats/cve-2026-43040-linux-kernel-information-leak-in-ipv6-ndisc-nduseroptmsg)
- [Linux kernel information leak in tc_chain_fill_node](https://junglewise.ai/threats/cve-2026-43035-linux-kernel-information-leak-in-tc-chain-fill-node)
- [Linux Kernel memory corruption in crypto authencesn decryption](https://junglewise.ai/threats/cve-2026-43033-linux-kernel-memory-corruption-in-crypto-authencesn-decryption)
- [Linux Kernel BPF verifier incorrect state pruning in regsafe](https://junglewise.ai/threats/cve-2026-43030-linux-kernel-bpf-verifier-incorrect-state-pruning-in-regsafe)