Vulnerability in GNU Glibc
CVE-2026-6238
The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.
EPSS: 0.004 (28.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L.
Affected products
- Gnu Glibc
- The Gnu C Library Glibc — versions 2.2, 2.0.1
Weakness classification (CWE)
References
- 3ff69d7a-14f2-4f67-a097-88dee7810d18 (Issue Tracking)
- 3ff69d7a-14f2-4f67-a097-88dee7810d18 (Third Party Advisory)
- 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Frequently asked questions
- What is CVE-2026-6238?
- CVE-2026-6238 is a medium-severity vulnerability in GNU Glibc, classified under Buffer Over-read. CVSS score: 6.5/10. Published 2026-04-28.
- How severe is CVE-2026-6238?
- Medium severity. CVSS v3 base score is 6.5 out of 10.