Vulnerability record · CVE-2026-6238 · published 28 April 2026

CVE-2026-6238: Gnu glibc vulnerability

Gnu · Glibc

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.

6.5 CVSS 3.1 Medium EPSS 0.44% · top 63.9% CWE-126 · CWE-126

6.5CVSS 3.1 base score

0.44%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

3References

14 Jul 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Glibc Gnu

References

Link	Tags
https://inbox.sourceware.org/libc-announce/[email protected]/T/#u	Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=34069	Issue Tracking
https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Track CVE-2026-6238 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2023-4911GNU C Library ld.so GLIBC_TUNABLES heap buffer overflowThe GNU C Library dynamic loader ld.so mishandles the GLIBC_TUNABLES environment variable, causing a heap-based buffer overflow and out-of-bounds wri…KEVEPSS 81%analysed3 Oct 2023 10.0CVE-2015-0235glibc gethostbyname heap buffer overflow (GHOST)CVE-2015-0235 is a heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2 and other 2.x versions before 2.18. It is reach…EPSS 95%analysed28 Jan 2015 9.8CVE-2026-5450Gnu glibc heap-based buffer overflow vulnerabilityCalling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width spec…EPSS 0.72%20 Apr 2026 9.8CVE-2023-0687Gnu glibc classic buffer overflow vulnerabilityA vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file g…EPSS 1.1%6 Feb 2023 9.8CVE-2023-25139Gnu glibc out-of-bounds write vulnerabilitysprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelate…EPSS 1.4%3 Feb 2023 9.8CVE-2022-23218Gnu glibc classic buffer overflow vulnerabilityThe deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on t…EPSS 4.8%14 Jan 2022 9.8CVE-2022-23219Gnu glibc classic buffer overflow vulnerabilityThe deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on …EPSS 4.3%14 Jan 2022 9.8CVE-2021-33574Gnu glibc use after free vulnerabilityThe mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes ob…EPSS 2.9%25 May 2021

Source: NIST National Vulnerability Database (record CVE-2026-6238), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.