Vulnerability-Lookup

ubuntu-cve-2026-6238

Vulnerability from osv_ubuntu

Published

2026-04-28 19:37

Modified

2026-07-27 18:42

Summary

Details

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.

Severity

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-6238	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-6238	REPORT
	https://sourceware.org/git/?p=glibc.git;a=blob_pl…	REPORT
	https://inbox.sourceware.org/libc-alpha/cover.177…	REPORT
	https://ubuntu.com/security/notices/USN-8611-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "eglibc-source",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-armel",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-dev-armel",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-pic",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-prof",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "multiarch-support",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.19-0ubuntu6.15+esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "eglibc",
        "purl": "pkg:deb/ubuntu/eglibc@2.19-0ubuntu6.15+esm4?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.17-93ubuntu4",
        "2.18-0ubuntu1",
        "2.18-0ubuntu2",
        "2.18-0ubuntu4",
        "2.18-0ubuntu5",
        "2.18-0ubuntu6",
        "2.18-0ubuntu7",
        "2.19-0ubuntu2",
        "2.19-0ubuntu3",
        "2.19-0ubuntu4",
        "2.19-0ubuntu5",
        "2.19-0ubuntu6",
        "2.19-0ubuntu6.1",
        "2.19-0ubuntu6.3",
        "2.19-0ubuntu6.4",
        "2.19-0ubuntu6.5",
        "2.19-0ubuntu6.6",
        "2.19-0ubuntu6.7",
        "2.19-0ubuntu6.8",
        "2.19-0ubuntu6.9",
        "2.19-0ubuntu6.10",
        "2.19-0ubuntu6.11",
        "2.19-0ubuntu6.13",
        "2.19-0ubuntu6.14",
        "2.19-0ubuntu6.15",
        "2.19-0ubuntu6.15+esm1",
        "2.19-0ubuntu6.15+esm2",
        "2.19-0ubuntu6.15+esm3",
        "2.19-0ubuntu6.15+esm4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "glibc-source",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-armel",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-dev-armel",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-dev-s390",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-pic",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-s390",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "locales",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "locales-all",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "multiarch-support",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.23-0ubuntu11.3+esm9"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "glibc",
        "purl": "pkg:deb/ubuntu/glibc@2.23-0ubuntu11.3+esm9?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.21-0ubuntu4",
        "2.21-0ubuntu5",
        "2.21-0ubuntu6",
        "2.23-0ubuntu1",
        "2.23-0ubuntu2",
        "2.23-0ubuntu3",
        "2.23-0ubuntu4",
        "2.23-0ubuntu5",
        "2.23-0ubuntu6",
        "2.23-0ubuntu7",
        "2.23-0ubuntu9",
        "2.23-0ubuntu10",
        "2.23-0ubuntu11",
        "2.23-0ubuntu11.2",
        "2.23-0ubuntu11.3",
        "2.23-0ubuntu11.3+esm1",
        "2.23-0ubuntu11.3+esm2",
        "2.23-0ubuntu11.3+esm3",
        "2.23-0ubuntu11.3+esm5",
        "2.23-0ubuntu11.3+esm6",
        "2.23-0ubuntu11.3+esm7",
        "2.23-0ubuntu11.3+esm8",
        "2.23-0ubuntu11.3+esm9"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "glibc-source",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-armel",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-dev-armel",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-dev-s390",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-lse",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-pic",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-s390",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "locales",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "locales-all",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "multiarch-support",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.27-3ubuntu1.6+esm6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "glibc",
        "purl": "pkg:deb/ubuntu/glibc@2.27-3ubuntu1.6+esm6?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.26-0ubuntu2",
        "2.26-0ubuntu2.1",
        "2.27-0ubuntu2",
        "2.27-0ubuntu3",
        "2.27-3ubuntu1",
        "2.27-3ubuntu1.2",
        "2.27-3ubuntu1.3",
        "2.27-3ubuntu1.4",
        "2.27-3ubuntu1.5",
        "2.27-3ubuntu1.6",
        "2.27-3ubuntu1.6+esm1",
        "2.27-3ubuntu1.6+esm2",
        "2.27-3ubuntu1.6+esm3",
        "2.27-3ubuntu1.6+esm4",
        "2.27-3ubuntu1.6+esm5",
        "2.27-3ubuntu1.6+esm6"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "glibc-source",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-armel",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-dev-armel",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-dev-s390",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-lse",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-pic",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-prof",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-s390",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "locales",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "locales-all",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.31-0ubuntu9.18+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "glibc",
        "purl": "pkg:deb/ubuntu/glibc@2.31-0ubuntu9.18+esm1?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.30-0ubuntu2",
        "2.30-0ubuntu3",
        "2.31-0ubuntu5",
        "2.31-0ubuntu6",
        "2.31-0ubuntu7",
        "2.31-0ubuntu9",
        "2.31-0ubuntu9.1",
        "2.31-0ubuntu9.2",
        "2.31-0ubuntu9.3",
        "2.31-0ubuntu9.7",
        "2.31-0ubuntu9.9",
        "2.31-0ubuntu9.12",
        "2.31-0ubuntu9.14",
        "2.31-0ubuntu9.15",
        "2.31-0ubuntu9.16",
        "2.31-0ubuntu9.17",
        "2.31-0ubuntu9.18",
        "2.31-0ubuntu9.18+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "glibc-source",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc-devtools",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6-dev-s390",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6-prof",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6-s390",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "locales",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "locales-all",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.35-0ubuntu3.14"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "glibc",
        "purl": "pkg:deb/ubuntu/glibc@2.35-0ubuntu3.14?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.35-0ubuntu3.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.34-0ubuntu3",
        "2.35-0ubuntu1",
        "2.35-0ubuntu3",
        "2.35-0ubuntu3.1",
        "2.35-0ubuntu3.3",
        "2.35-0ubuntu3.4",
        "2.35-0ubuntu3.5",
        "2.35-0ubuntu3.6",
        "2.35-0ubuntu3.7",
        "2.35-0ubuntu3.8",
        "2.35-0ubuntu3.9",
        "2.35-0ubuntu3.10",
        "2.35-0ubuntu3.11",
        "2.35-0ubuntu3.12",
        "2.35-0ubuntu3.13"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "glibc-source",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc-devtools",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc6-dev-s390",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc6-s390",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "locales",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "locales-all",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.39-0ubuntu8.8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "glibc",
        "purl": "pkg:deb/ubuntu/glibc@2.39-0ubuntu8.8?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.39-0ubuntu8.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.38-1ubuntu6",
        "2.38-3ubuntu1",
        "2.39-0ubuntu1",
        "2.39-0ubuntu2",
        "2.39-0ubuntu6",
        "2.39-0ubuntu8",
        "2.39-0ubuntu8.1",
        "2.39-0ubuntu8.2",
        "2.39-0ubuntu8.3",
        "2.39-0ubuntu8.4",
        "2.39-0ubuntu8.5",
        "2.39-0ubuntu8.6",
        "2.39-0ubuntu8.7"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "glibc-source",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc-devtools",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "locales",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "locales-all",
            "binary_version": "2.42-0ubuntu3.1"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.42-0ubuntu3.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "glibc",
        "purl": "pkg:deb/ubuntu/glibc@2.42-0ubuntu3.1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.41-6ubuntu1",
        "2.41-6ubuntu2",
        "2.41-9ubuntu1",
        "2.42-0ubuntu1",
        "2.42-0ubuntu3",
        "2.42-0ubuntu3.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "glibc-source",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc-devtools",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc-gconv-modules-extra",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "locales",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "locales-all",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.43-2ubuntu2.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "glibc",
        "purl": "pkg:deb/ubuntu/glibc@2.43-2ubuntu2.3?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.43-2ubuntu2.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.42-0ubuntu3",
        "2.42-2ubuntu1",
        "2.42-2ubuntu2",
        "2.42-2ubuntu4",
        "2.42-2ubuntu5",
        "2.43-2ubuntu1",
        "2.43-2ubuntu2"
      ]
    }
  ],
  "aliases": [],
  "details": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions.",
  "id": "UBUNTU-CVE-2026-6238",
  "modified": "2026-07-27T18:42:25Z",
  "published": "2026-04-28T19:37:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-6238"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6238"
    },
    {
      "type": "REPORT",
      "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0012"
    },
    {
      "type": "REPORT",
      "url": "https://inbox.sourceware.org/libc-alpha/cover.1777546194.git.fweimer@redhat.com/"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8611-1"
    }
  ],
  "related": [
    "USN-8611-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-6238"
  ]
}

CVE-2026-6238 (GCVE-0-2026-6238)

Vulnerability from cvelistv5 – Published: 2026-04-28 16:43 – Updated: 2026-07-14 12:45

Title

Buffer overread in ns_printrrf with corrupted RDATA field

Summary

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-28 18:51 UTC

CWE

CWE-126 - Buffer over-read

Assigner

glibc redhat root

References

3 references

URL	Tags
https://sourceware.org/bugzilla/show_bug.cgi?id=34069
https://inbox.sourceware.org/libc-announce/7a655d…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

4 products

Vendor	Product	Version
The GNU C Library	glibc	Affected: 2.0.1 , ≤ 2.43 (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < V3.1.6 (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < V3.1.6 (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < V3.1.6 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-6238",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-28T18:51:21.285963Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-28T18:51:25.367Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.6",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.6",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.6",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.6",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.6",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:45:33.280Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "glibc",
          "vendor": "The GNU C Library",
          "versions": [
            {
              "lessThanOrEqual": "2.43",
              "status": "affected",
              "version": "2.0.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.\u003c/p\u003e\u003cdiv\u003eThese functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions.\u003c/div\u003e"
            }
          ],
          "value": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.\n\nThese functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-598",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-598 DNS Spoofing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-126",
              "description": "CWE-126 Buffer over-read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-19T20:40:00.060Z",
        "orgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
        "shortName": "glibc"
      },
      "references": [
        {
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34069"
        },
        {
          "url": "https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Buffer overread in ns_printrrf with corrupted RDATA field",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
    "assignerShortName": "glibc",
    "cveId": "CVE-2026-6238",
    "datePublished": "2026-04-28T16:43:08.526Z",
    "dateReserved": "2026-04-13T16:56:08.986Z",
    "dateUpdated": "2026-07-14T12:45:33.280Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

usn-8611-1

Vulnerability from osv_ubuntu

Published

2026-07-27 12:24

Modified

2026-07-27 12:24

Summary

glibc vulnerabilities

Details

It was discovered that the GNU C Library iconv function incorrectly handled certain IBM character sets. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-4046)

It was discovered that the GNU C Library DNS functions incorrectly handled certain DNS server responses when using gethostbyaddr or gethostbyaddr_r. An attacker in a privileged network position could possibly use this issue to cause an application to violate DNS specification or obtain incorrect hostname information. This issue only affected Ubuntu 24.04 LTS. (CVE-2026-4437, CVE-2026-4438)

It was discovered that the GNU C Library deprecated debugging functions incorrectly enforced caller-supplied buffer lengths. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-5435)

It was discovered that the GNU C Library scanf family of functions contained a heap buffer overflow when processing certain format specifiers. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-5450)

It was discovered that the GNU C Library ungetwc function incorrectly handled certain character encodings. An attacker could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-5928)

It was discovered that the GNU C Library deprecated debugging functions incorrectly validated DNS response record data. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-6238)

References

URL

Type

	https://ubuntu.com/security/notices/USN-8611-1	ADVISORY
	https://ubuntu.com/security/CVE-2026-4046	REPORT
	https://ubuntu.com/security/CVE-2026-4437	REPORT
	https://ubuntu.com/security/CVE-2026-4438	REPORT
	https://ubuntu.com/security/CVE-2026-5435	REPORT
	https://ubuntu.com/security/CVE-2026-5450	REPORT
	https://ubuntu.com/security/CVE-2026-5928	REPORT
	https://ubuntu.com/security/CVE-2026-6238	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-4046",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-5435",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-5450",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-5928",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-6238",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "glibc-source",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc-devtools",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6-dev-s390",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6-prof",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6-s390",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "locales",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "locales-all",
            "binary_version": "2.35-0ubuntu3.14"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.35-0ubuntu3.14"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "glibc",
        "purl": "pkg:deb/ubuntu/glibc@2.35-0ubuntu3.14?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.35-0ubuntu3.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.34-0ubuntu3",
        "2.35-0ubuntu1",
        "2.35-0ubuntu3",
        "2.35-0ubuntu3.1",
        "2.35-0ubuntu3.3",
        "2.35-0ubuntu3.4",
        "2.35-0ubuntu3.5",
        "2.35-0ubuntu3.6",
        "2.35-0ubuntu3.7",
        "2.35-0ubuntu3.8",
        "2.35-0ubuntu3.9",
        "2.35-0ubuntu3.10",
        "2.35-0ubuntu3.11",
        "2.35-0ubuntu3.12",
        "2.35-0ubuntu3.13"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-4046",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-4437",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-4438",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-5435",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-5450",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-5928",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-6238",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "glibc-source",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc-devtools",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc6-dev-s390",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc6-s390",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "locales",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "locales-all",
            "binary_version": "2.39-0ubuntu8.8"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.39-0ubuntu8.8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "glibc",
        "purl": "pkg:deb/ubuntu/glibc@2.39-0ubuntu8.8?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.39-0ubuntu8.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.38-1ubuntu6",
        "2.38-3ubuntu1",
        "2.39-0ubuntu1",
        "2.39-0ubuntu2",
        "2.39-0ubuntu6",
        "2.39-0ubuntu8",
        "2.39-0ubuntu8.1",
        "2.39-0ubuntu8.2",
        "2.39-0ubuntu8.3",
        "2.39-0ubuntu8.4",
        "2.39-0ubuntu8.5",
        "2.39-0ubuntu8.6",
        "2.39-0ubuntu8.7"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-4046",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-5435",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-5450",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-5928",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-6238",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:26.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "glibc-source",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc-devtools",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc-gconv-modules-extra",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "locales",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "locales-all",
            "binary_version": "2.43-2ubuntu2.3"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.43-2ubuntu2.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "glibc",
        "purl": "pkg:deb/ubuntu/glibc@2.43-2ubuntu2.3?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.43-2ubuntu2.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.42-0ubuntu3",
        "2.42-2ubuntu1",
        "2.42-2ubuntu2",
        "2.42-2ubuntu4",
        "2.42-2ubuntu5",
        "2.43-2ubuntu1",
        "2.43-2ubuntu2"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that the GNU C Library iconv function incorrectly handled\ncertain IBM character sets. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2026-4046)\n\nIt was discovered that the GNU C Library DNS functions incorrectly handled\ncertain DNS server responses when using gethostbyaddr or gethostbyaddr_r.\nAn attacker in a privileged network position could possibly use this issue\nto cause an application to violate DNS specification or obtain incorrect\nhostname information. This issue only affected Ubuntu 24.04 LTS.\n(CVE-2026-4437, CVE-2026-4438)\n\nIt was discovered that the GNU C Library deprecated debugging functions\nincorrectly enforced caller-supplied buffer lengths. An attacker could\npossibly use this issue to cause a denial of service or execute arbitrary\ncode. (CVE-2026-5435)\n\nIt was discovered that the GNU C Library scanf family of functions\ncontained a heap buffer overflow when processing certain format specifiers.\nAn attacker could possibly use this issue to cause a denial of service or\nexecute arbitrary code. (CVE-2026-5450)\n\nIt was discovered that the GNU C Library ungetwc function incorrectly\nhandled certain character encodings. An attacker could possibly use this\nissue to obtain sensitive information or cause a denial of service.\n(CVE-2026-5928)\n\nIt was discovered that the GNU C Library deprecated debugging functions\nincorrectly validated DNS response record data. An attacker could possibly\nuse this issue to cause a denial of service or obtain sensitive\ninformation. (CVE-2026-6238)",
  "id": "USN-8611-1",
  "modified": "2026-07-27T12:24:25Z",
  "published": "2026-07-27T12:24:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8611-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-4046"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-4437"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-4438"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-5435"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-5450"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-5928"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-6238"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "glibc vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2026-4046",
    "UBUNTU-CVE-2026-4437",
    "UBUNTU-CVE-2026-4438",
    "UBUNTU-CVE-2026-5435",
    "UBUNTU-CVE-2026-5450",
    "UBUNTU-CVE-2026-5928",
    "UBUNTU-CVE-2026-6238"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

ubuntu-cve-2026-6238

Vulnerability from osv_ubuntu

CVE-2026-6238 (GCVE-0-2026-6238)

usn-8611-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour