{"id":"CVE-2018-19591","title":"In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed","summary":"In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-20","CWE-404"],"vendor":"gnu","product":"glibc","affected":["glibc <= 2.28","fedora = 28","fedora = 29"],"published":"2018-12-04","updated":"2026-10-14","sourceUpdated":"2026-10-14T07:16:43.377","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2018-19591","references":[{"url":"http://www.securityfocus.com/bid/106037","label":"cve@mitre.org"},{"url":"http://www.securitytracker.com/id/1042174","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BO7WHN52GFMC5F2I2232GFIPSSXWFV7G/","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M52KE4YR3GNMHQUOS3DKAGZD5TQ5D5UH/","label":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/201903-09","label":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/201908-06","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20190321-0003/","label":"cve@mitre.org"},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=23927","label":"cve@mitre.org"},{"url":"https://sourceware.org/git/?p=glibc.git%3Ba=blob_plain%3Bf=NEWS%3Bhb=HEAD","label":"cve@mitre.org"},{"url":"https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commitdiff%3Bh=d527c860f5a3f0ed687bd03f0cb464612dc23408","label":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/4416-1/","label":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/106037","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1042174","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BO7WHN52GFMC5F2I2232GFIPSSXWFV7G/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M52KE4YR3GNMHQUOS3DKAGZD5TQ5D5UH/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201903-09","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201908-06","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20190321-0003/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=23927","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://sourceware.org/git/?p=glibc.git%3Ba=blob_plain%3Bf=NEWS%3Bhb=HEAD","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commitdiff%3Bh=d527c860f5a3f0ed687bd03f0cb464612dc23408","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4416-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd"],"epss":0.05532,"epssPercentile":0.92654,"ingestedAt":"2026-10-14T07:21:04.803Z","slug":"CVE-2018-19591","body":"## Overview\n\nIn the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.\n\n## Affected\n\n- `glibc <= 2.28`\n- `fedora = 28`\n- `fedora = 29`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":1.1,"exploitation":0,"ransomware":0},"changes":[]}