CVE-2026-4438CWE-20

gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames

Medium · published March 20, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
25.1
In the wild
Unconfirmed
What it is

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00332 · 25.1th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-03-20T19:59Z
EPSS history
Timeline
  • 20 MAR 19:59Z
    gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
    cvelistv5