CVE-2026-4438

MediumCVSS 5.4/10Last modified Jul 14, 2026

Description

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-20 CWE-88

Affected software

Vendor	Product	Versions
The GNU C Library	glibc	>= 2.34, <= 2.43
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.5, < V3.1.6
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.5, < V3.1.6
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.5, < V3.1.6
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.5, < V3.1.6
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.5, < V3.1.6

References

https://sourceware.org/bugzilla/show_bug.cgi?id=34015Exploit, Issue Tracking, Patch
https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Timeline

Published: Mar 20, 2026
Last modified: Jul 14, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-443807.2MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, an improper access control vulnerability in the authentica CVE-2026-443815.3MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed in the handling of u CVE-2026-443837.5Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instan CVE-2026-443875.1ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability CVE-2026-44398.8Out of bounds memory access in WebGL in Google Chrome on Android prior to 146.0.7680.153 allowed a remote attacker to potentially perform a CVE-2026-443905.3NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to CVE-2026-443925.3Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in CVE-2026-443937.4An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname v CVE-2026-443948.1An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the origina CVE-2026-44408.8Out of bounds read and write in WebGL in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform arbitrary read/write via CVE-2026-444009.8MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile portal that allows a CVE-2026-444014.8Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability in the Markdown parser extension that allows authenticated