Is CVE-2026-8674 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8674 being exploited in the wild.

How severe is CVE-2026-8674?

Medium severity, with a CVSS score of 5.3, published 17 September 2026.

Is there a fix for CVE-2026-8674?

A patch was published on 2026-09-16: Fix applied in glibc 2.45 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8674 attacked?

It is attacked over the network or from the adjacent network or with local access, in a software library.

Am I affected by CVE-2026-8674?

Check whether you run Gnu C Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8674: GNU C Library DNS resolver assertion failure in search list parsing

CVE-2026-8674 · Severity: medium · CVSS 5.3 · Published 2026-09-17

The GNU C Library's DNS resolver crashes when processing excessively long domain search lists from /etc/resolv.conf or LOCALDOMAIN environment variables. An attacker on the local network could trigger this denial of service by injecting malicious DNS configuration through DHCP or VPN, causing any application using the resolver to abort and become unavailable.

Technologies: Gnu C Library. Vendors: Gnu.

Quick answers

Is CVE-2026-8674 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8674 being exploited in the wild.
How severe is CVE-2026-8674?: Medium severity, with a CVSS score of 5.3, published 17 September 2026.
Which products and versions are affected?: Gnu C Library 2.26 to 2.44.
Is there a fix for CVE-2026-8674?: A patch was published on 2026-09-16: Fix applied in glibc 2.45 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8674 attacked?: It is attacked over the network or from the adjacent network or with local access, in a software library.
Am I affected by CVE-2026-8674?: Check whether you run Gnu C Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an assertion failure in resolv_conf.c:update_from_conf() that occurs when parsing DNS search domains exceeding ~200 characters in combined length. The resolver truncates the search list to fit the fixed-size _res.defdname buffer but then performs a consistency check against the wrong size, causing the assertion to fail. The root cause is that the code does not properly handle the first entry that does not fit. Attack vector is local network (DHCP/VPN) or local process configuration; no authentication or special privileges required on the target system. Exploitation causes immediate process abort via assertion failure. The fix was applied in glibc 2.45 (commit 506ea57086bfb9ce3daff1c14246a1cb532aba0a).

Affected products

GNU C Library 2.26 to 2.44

Timeline

2023-11-02: disclosed: Bug reported by Joshua Rogers
2026-09-17: advisory: CVE-2026-8674 published
2026-09-16: patched: Fix applied in glibc 2.45

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.