Executive brief
A vulnerability exists in the GNU C Library (glibc), a fundamental software component used by almost all Linux-based systems. Certain legacy functions used for debugging DNS data do not properly validate the size of incoming information, which could allow a remote attacker to crash an application or potentially view sensitive memory contents. However, because these functions are deprecated and typically only used for debugging rather than standard web browsing or network lookups, the real-world risk to most production operations is limited.
Technical details
A buffer over-read vulnerability (CWE-126) exists in the deprecated glibc functions ns_printrrf, ns_printrr, and fp_nquery. The root cause is a failure to validate RDATA content against the specified RDATA length when processing specific DNS record types, including A6, CERT, LOC, TKEY, and TSIG. An attacker can exploit this by crafting a malicious DNS response that, when processed by a vulnerable application using these specific debugging interfaces, triggers an out-of-bounds read. This can result in a denial-of-service (crash) or the disclosure of uninitialized memory. The vulnerability is reachable over the network without authentication, though the affected functions are not part of the standard glibc resolver path. The issue is fixed in glibc version 2.44.
Affected products
- GNU glibc 2.0.1 to 2.43
Timeline
- 2026-04-11: disclosed: Vulnerability reported by Florian Weimer
- 2026-04-28: advisory: Initial security advisory published
- 2026-06-19: patched: Fixes committed to glibc master branch for version 2.44