Skip to content

GLIBC-SA-2026-0012 on CTRL-OS 26.05

Aliases: GLIBC-SA-2026-0012, CVE-2026-6238

Packages: glibc

Status: In Progress

Advisory Information

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the
GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA
content against the RDATA length in a DNS response when processing A6,
CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a
DNS response, causing a target application to crash or read
uninitialized memory.

These functions are for application debugging only and hence not in the
path of code executed by the DNS resolver.  Further, they have been
deprecated since version 2.34 and should not be used by any new
applications.  Applications should consider porting away from these
interfaces since they may be removed in future versions.

CVE-Id: CVE-2026-6238
Public-Date: 2026-04-11
Vulnerable-Commit: ee188d555b8c32ad9704a7440cab400af967292f (1.90)

Updates

2026-07-18 00:23 CEST

Metadata changes:

  • Status for package glibc: “In Progress” (f48798d58d89c52ac06cd3880ad9b91a0f90a5b2)

(Amended on: 2026-07-18 00:24 CEST)

2026-07-01 10:55 CEST

Comment:

Proposed fix in Nixpkgs unstable: https://github.com/NixOS/nixpkgs/pull/537324

2026-06-30 15:33 CEST

Metadata changes:

  • Status for package glibc: “Plausible”

Comment:

Fixed for 2.44, but 26.05 is at 2.42.

2026-05-28 23:40 CEST

Metadata changes:

  • Status for package glibc: “New”