The GNU C Library security advisories update for 2026-09-17

[Adhemerval Zanella Netto <adhemerval.zanella () linaro org>]

The following security advisories have been published:

GLIBC-SA-2026-0021:
===================
Assertion failure in the DNS stub resolver with a long search domain

Initializing the DNS stub resolver from an /etc/resolv.conf file, or a
LOCALDOMAIN environment variable, whose search list contains a domain
of roughly 200 characters or more in the GNU C Library version 2.26 to
2.44 results in an assertion failure which aborts the process.

The resolver truncates the search list when copying it into the
fixed-size _res.defdname buffer, then asserts that the copy is
consistent with the full configuration.  The consistency check
compared against the wrong size and did not handle a first entry that
does not fit, so a correctly truncated list failed the assertion.  Any
process that resolves names through the library is affected, including
long-running processes that reload /etc/resolv.conf on the next query
after it changes.  Search domains are commonly written to
/etc/resolv.conf from data received over DHCP or from a VPN server, so
an attacker on the local network may be able to trigger this without
privileges on the target system, subject to validation by the network
configuration software.

CVE-Id: CVE-2026-8674
Public-Date: 2023-11-07
Vulnerable-Commit: 3f853f22c87f0b671c0366eb290919719fa56c0e (2.26)
Fix-Commit: 506ea57086bfb9ce3daff1c14246a1cb532aba0a (2.45)
Reported-by: Joshua Rogers - joshua () joshua hu
CVSS: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - 5.3