Executive brief
The GNU C Library's DNS resolver crashes when processing excessively long domain search lists from /etc/resolv.conf or LOCALDOMAIN environment variables. An attacker on the local network could trigger this denial of service by injecting malicious DNS configuration through DHCP or VPN, causing any application using the resolver to abort and become unavailable.
Technical details
The vulnerability is an assertion failure in resolv_conf.c:update_from_conf() that occurs when parsing DNS search domains exceeding ~200 characters in combined length. The resolver truncates the search list to fit the fixed-size _res.defdname buffer but then performs a consistency check against the wrong size, causing the assertion to fail. The root cause is that the code does not properly handle the first entry that does not fit. Attack vector is local network (DHCP/VPN) or local process configuration; no authentication or special privileges required on the target system. Exploitation causes immediate process abort via assertion failure. The fix was applied in glibc 2.45 (commit 506ea57086bfb9ce3daff1c14246a1cb532aba0a).
Affected products
- GNU C Library 2.26 to 2.44
Timeline
- 2023-11-02: disclosed: Bug reported by Joshua Rogers
- 2026-09-17: advisory: CVE-2026-8674 published
- 2026-09-16: patched: Fix applied in glibc 2.45