# CVE-2026-6238: GNU glibc buffer over-read in DNS debugging functions

Source: https://junglewise.ai/threats/cve-2026-6238-gnu-glibc-buffer-over-read-in-dns-debugging-functions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-28. Updated: 2026-06-19  
License: CC BY 4.0 with a link back

CVE-2026-6238 · Severity: medium · CVSS 6.5 · Published 2026-04-28

A vulnerability exists in the GNU C Library (glibc), a fundamental software component used by almost all Linux-based systems. Certain legacy functions used for debugging DNS data do not properly validate the size of incoming information, which could allow a remote attacker to crash an application or potentially view sensitive memory contents. However, because these functions are deprecated and typically only used for debugging rather than standard web browsing or network lookups, the real-world risk to most production operations is limited.

Technologies: [Gnu Glibc](https://junglewise.ai/threats/technologies/glibc). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-6238 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6238 being exploited in the wild.

**How severe is CVE-2026-6238?** Medium severity, with a CVSS score of 6.5, published 28 April 2026.

**Which products and versions are affected?** Gnu Glibc 2.0.1 to 2.43.

**Is there a fix for CVE-2026-6238?** A patch was published on 2026-06-19: Fixes committed to glibc master branch for version 2.44 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6238 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6238?** Check whether you run Gnu Glibc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer over-read vulnerability (CWE-126) exists in the deprecated glibc functions ns_printrrf, ns_printrr, and fp_nquery. The root cause is a failure to validate RDATA content against the specified RDATA length when processing specific DNS record types, including A6, CERT, LOC, TKEY, and TSIG. An attacker can exploit this by crafting a malicious DNS response that, when processed by a vulnerable application using these specific debugging interfaces, triggers an out-of-bounds read. This can result in a denial-of-service (crash) or the disclosure of uninitialized memory. The vulnerability is reachable over the network without authentication, though the affected functions are not part of the standard glibc resolver path. The issue is fixed in glibc version 2.44.

## Affected products

- GNU glibc 2.0.1 to 2.43

## Timeline

- 2026-04-11: disclosed: Vulnerability reported by Florian Weimer
- 2026-04-28: advisory: Initial security advisory published
- 2026-06-19: patched: Fixes committed to glibc master branch for version 2.44

## References

- [https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/](https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/)
- [https://sourceware.org/bugzilla/show_bug.cgi?id=34069](https://sourceware.org/bugzilla/show_bug.cgi?id=34069)

## Related threats

- [GNU glibc out-of-bounds write in ns_printrrf TSIG handling](https://junglewise.ai/threats/cve-2026-5435-gnu-glibc-out-of-bounds-write-in-ns-printrrf-tsig-handling)
- [GNU C Library glibc buffer under-read in ungetwc](https://junglewise.ai/threats/cve-2026-5928-gnu-c-library-glibc-buffer-under-read-in-ungetwc)
- [GNU glibc heap buffer overflow in scanf %mc specifier](https://junglewise.ai/threats/cve-2026-5450-gnu-glibc-heap-buffer-overflow-in-scanf-mc-specifier)
- [GNU glibc assertion failure in iconv character conversion](https://junglewise.ai/threats/cve-2026-4046-gnu-glibc-assertion-failure-in-iconv-character-conversion)
- [GNU glibc improper input validation in gethostbyaddr](https://junglewise.ai/threats/cve-2026-4438-gnu-glibc-improper-input-validation-in-gethostbyaddr)