CVE-2026-6238 Details
Description
The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.
A buffer overread vulnerability has been identified in the GNU C Library (glibc) in versions 2.2 and newer. The issue arises in the deprecated functions ns_printrrf, ns_printrr, and fp_nquery, which are intended for application debugging but not for use by new applications. These functions fail to properly validate the RDATA content against the RDATA length in DNS responses when handling LOC, CERT, TKEY, or TSIG records. This oversight may allow an attacker to craft a DNS response that causes a target application to crash or read uninitialized memory. The vulnerability was discovered while developing a test case for another related issue.
Applications should avoid using the deprecated functions ns_printrrf, ns_printrr, and fp_nquery, as they may be removed in future versions of the GNU C Library. Instead, consider using alternative methods for handling DNS responses that include proper validation of RDATA lengths.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-082556.html | siemens-SADP | |
| https://inbox.sourceware.org/libc-announce/[email protected]/T/#u | GNU C Library | Third Party Advisory |
| https://sourceware.org/bugzilla/show_bug.cgi?id=34069 | GNU C Library | Issue Tracking |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-126 | Buffer Over-read | GNU C Library |
Affected Products
| Product | Versions |
|---|---|
| gnu glibc | >= 2.2 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | siemens-SADP |
| Jun 19, 2026 | CVE Modified | GNU C Library |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | GNU C Library |
| May 4, 2026 | Initial Analysis | [email protected] |
| Apr 28, 2026 | CVE Modified | CISA-ADP |
| Apr 28, 2026 | New CVE Received | GNU C Library |