{"id":"CVE-2026-4437","revision":"1bf98574cea848a7b477ea536a0c8012","records":[{"revision":"1bf98574cea848a7b477ea536a0c8012","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-4437","aliases":[],"title":"gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response","description":"Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.","state":0,"publishedAt":"2026-03-20T19:59:00.427+00:00","modifiedAt":"2026-10-15T01:12:09.122+00:00","affected":[{"ecosystem":"Vendor product","name":"glibc","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"The GNU C Library\",\n                    \"product\": \"glibc\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2.34\",\n                            \"lessThanOrEqual\": \"2.43\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://sourceware.org/bugzilla/show_bug.cgi?id=34014"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-4437","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-4437","identifiers":["CVE-2026-4437"]},"retained":false,"historicalAffected":[]}],"coverage":[]}