CVE-2026-4437: 
NixOS vulnerability analysis and mitigation

CVE-2026-4437 is a DNS response parsing flaw in the GNU C Library (glibc) affecting the gethostbyaddr and gethostbyaddr_r functions. When a DNS backend is configured via nsswitch.conf, a crafted response from the configured DNS server can cause the application to incorrectly treat a non-answer section of the DNS response as a valid answer, violating DNS specification compliance. The vulnerability affects glibc versions 2.34 through 2.43 and was publicly disclosed on March 20, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Feedly, Red Hat CVE).

The root cause is classified under CWE-125 (Out-of-bounds Read) and CWE-1286 (Improper Validation of Syntactic Correctness of Input). When gethostbyaddr or gethostbyaddr_r processes a DNS response, insufficient validation of the response structure allows a malformed packet — specifically one where a non-answer section is misidentified as an answer — to trigger an out-of-bounds read condition. Exploitation requires the attacker to control or intercept responses from the DNS server configured in the system's nsswitch.conf, meaning a network-positioned adversary (e.g., via DNS spoofing or a rogue DNS server) is the primary threat model. The upstream bug report is tracked at the GNU C Library Bugzilla (glibc Bugzilla, oss-sec).

Successful exploitation results in a Denial of Service (DoS) — affected applications can crash or become unresponsive when they call gethostbyaddr or gethostbyaddr_r and receive a crafted DNS response. There is no confirmed impact on confidentiality or integrity; the CVSS vector reflects a High availability impact with no confidentiality or integrity loss. Any application or service on a Linux system using glibc 2.34–2.43 with DNS-based hostname resolution is potentially affected, which could include a broad range of system services and user-space applications (Feedly, Red Hat CVE).

No confirmed in-the-wild exploitation has been observed, and no functional public exploit code is known to exist. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a network-positioned attacker capable of delivering crafted DNS responses to the target system, which limits opportunistic exploitation (Feedly).

1. Reconnaissance: Identify target systems running glibc versions 2.34–2.43 with DNS-based hostname resolution configured in /etc/nsswitch.conf (e.g., hosts: files dns).
2. Position for DNS interception: Gain a network position to intercept or respond to DNS queries from the target — this could be achieved via DNS spoofing, ARP poisoning on a local network, or by operating a rogue/malicious DNS server that the target is configured to use.
3. Trigger the vulnerable function: Cause the target application to call gethostbyaddr or gethostbyaddr_r (e.g., by initiating a reverse DNS lookup from the target system).
4. Craft malicious DNS response: Respond to the DNS query with a specially crafted DNS response packet where a non-answer section (e.g., authority or additional section) is structured to be misidentified as a valid answer, violating DNS specification.
5. Achieve DoS: The malformed response triggers an out-of-bounds read in glibc, causing the calling application to crash or become unresponsive (glibc Bugzilla, oss-sec).

• Network: Unusual or malformed DNS response packets targeting the host, particularly responses where non-answer sections contain unexpected resource records; DNS traffic from unexpected or unauthorized DNS server IP addresses.
• Logs: Application crash logs or core dumps associated with processes that call gethostbyaddr/gethostbyaddr_r; system logs (/var/log/syslog, journalctl) showing segmentation faults or abnormal termination of services performing reverse DNS lookups.
• Process: Unexpected termination or restart of services (e.g., nscd, web servers, mail servers) that perform hostname resolution; repeated process crashes correlated with DNS query activity.

The primary remediation is to update glibc to a version newer than 2.43. For Microsoft Azure Linux 3 users, patches are available for glibc versions 2.38-19 or later (MSRC). Red Hat has issued errata (RHSA-2026:19061, RHSA-2026:20587, RHSA-2026:20597, RHSA-2026:22634) for affected RHEL versions (Red Hat Errata). OpenSUSE and Debian have also released updated packages. As a workaround where patching is not immediately feasible, administrators can modify /etc/nsswitch.conf to avoid using the DNS backend for hostname resolution (e.g., using only files or an alternative resolver), though this may impact functionality.

The vulnerability received coverage from the Linux security community, including discussion on the oss-security mailing list and mentions in German Linux news outlet Pro-Linux.de across multiple distribution advisories. The Yocto Project security list also flagged the issue for embedded Linux users. Community reaction has been measured, consistent with a moderate-severity DoS vulnerability with no active exploitation — patch uptake appears to be progressing through standard distribution update channels (oss-sec, Yocto Security).