---
id: CVE-2018-19591
title: >-
  In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve
  a crafted hostname via getaddrinfo() leads to the allocation of a socket
  descriptor that is not closed
summary: >-
  In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve
  a crafted hostname via getaddrinfo() leads to the allocation of a socket
  descriptor that is not closed. This is related to the if_nametoindex()
  function.
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-20
  - CWE-404
vendor: gnu
product: glibc
affected:
  - glibc <= 2.28
  - fedora = 28
  - fedora = 29
published: '2018-12-04'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T07:16:43.377'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2018-19591'
references:
  - url: 'http://www.securityfocus.com/bid/106037'
    label: cve@mitre.org
  - url: 'http://www.securitytracker.com/id/1042174'
    label: cve@mitre.org
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BO7WHN52GFMC5F2I2232GFIPSSXWFV7G/
    label: cve@mitre.org
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M52KE4YR3GNMHQUOS3DKAGZD5TQ5D5UH/
    label: cve@mitre.org
  - url: 'https://security.gentoo.org/glsa/201903-09'
    label: cve@mitre.org
  - url: 'https://security.gentoo.org/glsa/201908-06'
    label: cve@mitre.org
  - url: 'https://security.netapp.com/advisory/ntap-20190321-0003/'
    label: cve@mitre.org
  - url: 'https://sourceware.org/bugzilla/show_bug.cgi?id=23927'
    label: cve@mitre.org
  - url: 'https://sourceware.org/git/?p=glibc.git%3Ba=blob_plain%3Bf=NEWS%3Bhb=HEAD'
    label: cve@mitre.org
  - url: >-
      https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commitdiff%3Bh=d527c860f5a3f0ed687bd03f0cb464612dc23408
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/4416-1/'
    label: cve@mitre.org
  - url: 'http://www.securityfocus.com/bid/106037'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.securitytracker.com/id/1042174'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BO7WHN52GFMC5F2I2232GFIPSSXWFV7G/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M52KE4YR3GNMHQUOS3DKAGZD5TQ5D5UH/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/201903-09'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/201908-06'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20190321-0003/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://sourceware.org/bugzilla/show_bug.cgi?id=23927'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://sourceware.org/git/?p=glibc.git%3Ba=blob_plain%3Bf=NEWS%3Bhb=HEAD'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commitdiff%3Bh=d527c860f5a3f0ed687bd03f0cb464612dc23408
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/4416-1/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.05532
epssPercentile: 0.92654
ingestedAt: '2026-10-14T07:21:04.803Z'
---

## Overview

In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

## Affected

- `glibc <= 2.28`
- `fedora = 28`
- `fedora = 29`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.