Source: glibc Version: 2.43-5 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for glibc. CVE-2026-8674[0]: | Initializing the DNS stub resolver from an /etc/resolv.conf file, or | a LOCALDOMAIN environment variable, whose search list contains a | domain of roughly 200 characters or more in the GNU C Library | version 2.26 to 2.44 results in an assertion failure which aborts | the process. The resolver truncates the search list when copying it | into the fixed-size _res.defdname buffer, then asserts that the copy | is consistent with the full configuration. The consistency check | compared against the wrong size and did not handle a first entry | that does not fit, so a correctly truncated list failed the | assertion. Any process that resolves names through the library is | affected, including long-running processes that reload | /etc/resolv.conf on the next query after it changes. Search domains | are commonly written to /etc/resolv.conf from data received over | DHCP or from a VPN server, so an attacker on the local network may | be able to trigger this without privileges on the target system, | subject to validation by the network configuration software. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-8674 https://www.cve.org/CVERecord?id=CVE-2026-8674 [1] https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0021 [2] https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a Please adjust the affected versions in the BTS as needed. Rgards, Salvatore
