Is CVE-2026-6238 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6238 being exploited in the wild.

How severe is CVE-2026-6238?

Medium severity, with a CVSS score of 6.5, published 28 April 2026.

Is there a fix for CVE-2026-6238?

A patch was published on 2026-06-19: Fixes committed to glibc master branch for version 2.44 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6238 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6238?

Check whether you run Gnu Glibc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6238: GNU glibc buffer over-read in DNS debugging functions

CVE-2026-6238 · Severity: medium · CVSS 6.5 · Published 2026-04-28

A vulnerability exists in the GNU C Library (glibc), a fundamental software component used by almost all Linux-based systems. Certain legacy functions used for debugging DNS data do not properly validate the size of incoming information, which could allow a remote attacker to crash an application or potentially view sensitive memory contents. However, because these functions are deprecated and typically only used for debugging rather than standard web browsing or network lookups, the real-world risk to most production operations is limited.

Technologies: Gnu Glibc. Vendors: Gnu.

Quick answers

Is CVE-2026-6238 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6238 being exploited in the wild.
How severe is CVE-2026-6238?: Medium severity, with a CVSS score of 6.5, published 28 April 2026.
Which products and versions are affected?: Gnu Glibc 2.0.1 to 2.43.
Is there a fix for CVE-2026-6238?: A patch was published on 2026-06-19: Fixes committed to glibc master branch for version 2.44 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6238 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6238?: Check whether you run Gnu Glibc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A buffer over-read vulnerability (CWE-126) exists in the deprecated glibc functions ns_printrrf, ns_printrr, and fp_nquery. The root cause is a failure to validate RDATA content against the specified RDATA length when processing specific DNS record types, including A6, CERT, LOC, TKEY, and TSIG. An attacker can exploit this by crafting a malicious DNS response that, when processed by a vulnerable application using these specific debugging interfaces, triggers an out-of-bounds read. This can result in a denial-of-service (crash) or the disclosure of uninitialized memory. The vulnerability is reachable over the network without authentication, though the affected functions are not part of the standard glibc resolver path. The issue is fixed in glibc version 2.44.

Affected products

GNU glibc 2.0.1 to 2.43

Timeline

2026-04-11: disclosed: Vulnerability reported by Florian Weimer
2026-04-28: advisory: Initial security advisory published
2026-06-19: patched: Fixes committed to glibc master branch for version 2.44

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.