Vulnerability in GNU Glibc
CVE-2026-6238
The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L.
EPSS exploit prediction
EPSS: 0.004 (37.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 37.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.001
Affected products
- GNU Glibc
- The GNU C Library Glibc — versions 2.2, 2.0.1
Weakness classification (CWE)
References
- 3ff69d7a-14f2-4f67-a097-88dee7810d18 (Issue Tracking)
- 3ff69d7a-14f2-4f67-a097-88dee7810d18 (Third Party Advisory)
- 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Frequently asked questions
- What is CVE-2026-6238?
- CVE-2026-6238 is a medium-severity vulnerability in GNU Glibc, classified under Buffer Over-read. CVSS score: 6.5/10. Published 2026-04-28.
- How severe is CVE-2026-6238?
- Medium severity. CVSS v3 base score is 6.5 out of 10.