CVE-2026-4438: gnu glibc Improper Input Validation
CVSS: 5.4v3.1MediumModified
AliasesUBUNTU-CVE-2026-4438DEBIAN-CVE-2026-4438CGA-2296-pv6c-h9q5CGA-22wp-6rhp-7fgqCGA-296p-qhr4-cm9fCGA-2w57-69gx-qjrrCGA-369h-pm43-hp3vCGA-382x-chmq-77jfCGA-3972-9h6q-v48fCGA-3ch4-xmqx-hqjfCGA-3j67-fpmv-qr5vCGA-3jvw-cpqx-f8w2CGA-3phf-2f7m-v697CGA-3w5m-4xhx-c478CGA-3w85-cw7x-rg45CGA-44j8-6v45-jf6pCGA-44m8-5gw6-5qvvCGA-4m2x-9337-hqgqCGA-4w93-3fmj-w88cCGA-4wr5-42jg-7w47CGA-522g-j78j-r84wCGA-5465-8jhf-3f4vCGA-592r-rc5f-q9fjCGA-5f3p-8m33-fmv7CGA-5g3g-p3hg-86gpCGA-5h5q-3r3v-xr9gCGA-5rwv-pr3h-v88pCGA-669p-h5jm-mmrqCGA-69hj-62mh-4q6xCGA-6gcm-c44c-75g9CGA-6rhv-37qh-fq35CGA-6wh8-7p52-3c8fCGA-722r-222x-hhhfCGA-768m-fc47-p253CGA-7fmh-pg32-8pv7CGA-7jh6-vjw4-x9w2CGA-7m75-gqhr-2593CGA-7rw8-gfw2-ggqjCGA-827c-jrvw-xrvmCGA-845g-7mf6-wg8wCGA-8hqq-6xqv-mwjrCGA-8rhc-f6xr-7xf8CGA-945j-rhg4-wgfcCGA-9x23-3c8x-8v88CGA-c53j-fx2j-57cfCGA-c8r4-qhfx-5jqjCGA-f4rw-cg9c-vrjmCGA-f97r-3958-g27vCGA-ff8c-fmqh-3mp9CGA-fg6j-4w5q-pjf3CGA-g99r-x2jf-98w7CGA-ggp7-r2pf-8xp8CGA-gq6j-c6pc-m64qCGA-grhq-766x-7vx8CGA-gvgj-3q6j-q9p4CGA-h452-mrp8-q9gpCGA-hh9v-w5cp-4pwcCGA-hhgw-gh3q-p687CGA-hqcm-f3h2-2wp2CGA-hvww-hgw9-jch2CGA-j38x-ww5c-c8w3CGA-j3f7-h2g8-xp9qCGA-j6qm-p76w-p72mCGA-j7vp-j5fh-gqj2CGA-j9pw-8rmq-mxhxCGA-jm9v-mp8v-2mrgCGA-jpvf-rh28-859hCGA-jqpq-8mc8-ggm4CGA-m7fg-wgp9-q98vCGA-mcq5-q7c6-7ppjCGA-p2ff-cm9m-p323CGA-p3w9-cqh6-vfc6CGA-p5f4-6r4j-9hv8CGA-p6x6-hc69-4485CGA-p954-rwjw-2p5hCGA-pfmv-47h7-9x9vCGA-ppqr-mqjw-p949CGA-pq78-qwc2-ww44CGA-q44q-9c7c-x3wgCGA-q4j5-vgfg-5cqwCGA-q89h-5j3w-f3m5CGA-r5f2-53cq-v488CGA-r7v3-3h8h-3wc3CGA-rcq5-8v72-9rhvCGA-rgf4-mgpf-f92xCGA-v7f5-3764-3jrgCGA-v7j4-84f6-84f3CGA-v7v5-jpv8-7r26CGA-v84v-ch33-cqj4CGA-vhmx-ww8j-hjwqCGA-vjrj-fr9w-c6ccCGA-vxvr-6vpf-xwcvCGA-w34j-6hrv-vp92CGA-w8cf-2mfg-3pwrCGA-wc6h-2f8p-p8rqCGA-wf74-v63j-cxxfCGA-wjxg-qg9g-gvv8CGA-wr5f-w4h6-mggfCGA-wrpj-h6wm-4267CGA-x246-7r3m-qfqmCGA-x4m3-c728-r38fCGA-x6wx-22fq-2rvcCGA-x7h8-g68j-w8q7CGA-x9rq-r5hh-4fjjCGA-xf59-59xg-2r6jCGA-xfc2-83ff-fc46CGA-xfrj-r28w-q7xhCGA-xrgv-v8jg-j6r5
Published 20-03-2026Last modified 15-10-2026
Vulnerability summary
CVE-2026-4438 is a medium (CVSS 5.4) Improper Input Validation vulnerability in gnu glibc. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.8% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.4/10
010
Medium · v3.1 (CVE.org)EPSS score
0.33%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 12 · Related 10Timeline
- 20-03-2026PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.
CVSS metrics
6 scores · 6 sources · 1 versionMedium 5.4Preferred score · CVE.org (CNA)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- NVDNIST5.4MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
25%
Versus all other CVEs
30-day change
+0.02 pp
From 0.32% on 19-09-2026
19-09-202619-10-2026
EPSS score0.33%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (sourceware.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Affected systems
Chainguard53 products
- glibc< 2.43-r4
- glibc-2.43< 2.43-r4
- glibc-2.43-abi-reportAll versions (No fix recorded)
- glibc-2.43-dev< 2.43-r4
- glibc-2.43-iconv< 2.43-r4
Wolfi53 products
- glibc< 2.43-r4
- glibc-2.43< 2.43-r4
- glibc-2.43-abi-reportAll versions (No fix recorded)
- glibc-2.43-dev< 2.43-r4
- glibc-2.43-iconv< 2.43-r4
Ubuntu2 products
- eglibcAll versions (No fix recorded)
- glibc< 2.39-0ubuntu8.8 | All versions (No fix recorded)
Debian1 product
- glibc< 2.36-9+deb12u14 | < 2.41-12+deb13u3 | < 2.42-14
Gnu1 product
- glibc≥ 2.34, ≤ 2.43
The gnu c library1 product
- glibc≥ 2.34, ≤ 2.43
6 vendors · 111 products
