CVE-2026-8674
MEDIUM 5.3Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 24th percentile
Impact if exploited
5.3CVSS 3.1 · MEDIUM
- ConfidentialityNone
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ⚠Access: Must sit on the same / adjacent network
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ⚠Complexity: Needs a race window or specific setup
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-617: Reachable Assertion
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References and research data (JSON)
Vendor product assessments
Showing 32 of 1901 vendor product statements; 1869 omitted. Read the full vendor advisory.
glibc-benchtests-debuginfo-0:2.39-145.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-ber-0:2.39-145.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-fil-0:2.39-145.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-ko-0:2.39-145.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-ne-0:2.39-145.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-so-0:2.39-145.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-wae-0:2.39-145.el10_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-agr-0:2.43-8.6.hum1@aarch64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-id-0:2.43-8.6.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-rw-0:2.43-8.6.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
sysroot-x86_64-fc43-glibc-0:2.43-8.6.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
compat-libpthread-nonshared as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/compat-libpthread-nonshared
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
glibc-langpack-da as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/glibc-langpack-da
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
glibc-langpack-iu as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/glibc-langpack-iu
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
glibc-langpack-niu as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/glibc-langpack-niu
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
glibc-langpack-te as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/glibc-langpack-te
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
glibc-all-langpacks as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/glibc-all-langpacks
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
glibc-langpack-de as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/glibc-langpack-de
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
glibc-langpack-ja as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/glibc-langpack-ja
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
glibc-langpack-niu as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/glibc-langpack-niu
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
glibc-langpack-te as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/glibc-langpack-te
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4 · known affected
Vendor assessment for this product only.
pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
compat-glibc-headers as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/compat-glibc-headers
Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00glibc as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/glibc
Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00glibc-devel as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/glibc-devel
Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00glibc-utils as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/glibc-utils
Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00nscd as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/nscd
Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00compat-glibc-headers as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/compat-glibc-headers
Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00glibc as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/glibc
Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00glibc-headers as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/glibc-headers
Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00glibc-utils as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/glibc-utils
Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00nscd as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/nscd
Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00
All CVSS metrics
- MEDIUM 5.3 v3.1 · CNA Primary
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - MEDIUM 5.3 v3.1 · NVD Secondary
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Patches & mitigations
- https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a CVE record · glibc · Updated 2026-09-17T16:54:27.310Z
NVD · CVE-2026-8674 · Updated 2026-09-18T18:17:47.257
Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00
Advisories
- https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021 CVE record · glibc · Updated 2026-09-17T16:54:27.310Z
NVD · CVE-2026-8674 · Updated 2026-09-18T18:17:47.257
Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00 - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8674.json Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-82326 EUVD · EUVD-2026-82326
Technical & other
- https://sourceware.org/bugzilla/show_bug.cgi?id=31026 CVE record · glibc · Updated 2026-09-17T16:54:27.310Z
NVD · CVE-2026-8674 · Updated 2026-09-18T18:17:47.257
Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00 - https://joshua.hu/fuzzing-glibc-libresolv CVE record · glibc · Updated 2026-09-17T16:54:27.310Z
NVD · CVE-2026-8674 · Updated 2026-09-18T18:17:47.257
Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00 - http://www.openwall.com/lists/oss-security/2026/09/17/4CVE record · CVE · Updated 2026-09-17T18:09:16.072Z
NVD · CVE-2026-8674 · Updated 2026-09-18T18:17:47.257 - https://access.redhat.com/security/cve/CVE-2026-8674 Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2536382 Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-8674 Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-8674 Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00
- https://access.redhat.com/errata/RHSA-2026:84753 Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00
- https://access.redhat.com/errata/RHSA-2026:69276 Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00
- https://access.redhat.com/errata/RHSA-2026:87400 Red Hat · CVE-2026-8674 · Updated 2026-10-22T05:50:38+00:00