CVE-2023-4806Medium· 5.9▾ SunlitA flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.4%
1.4% → 1.6%
A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nss_gethostbyname2_r and nss_getcanonname_r hooks without implementing the nss*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.
glibc = 2.33codeready_linux_builder_eus = 9.2codeready_linux_builder_eus_for_power_little_endian = 9.0_ppc64lecodeready_linux_builder_eus_for_power_little_endian_eus = 9.2_ppc64lecodeready_linux_builder_for_arm64 = 9.0_aarch64codeready_linux_builder_for_arm64_eus = 9.2_aarch64codeready_linux_builder_for_ibm_z_systems = 9.0_s390xcodeready_linux_builder_for_ibm_z_systems_eus = 9.2_s390xenterprise_linux = 7.0enterprise_linux = 8.0enterprise_linux = 9.0enterprise_linux_eus = 8.8enterprise_linux_eus = 9.2enterprise_linux_for_arm_64 = 9.0_aarch64enterprise_linux_for_arm_64_eus = 9.2_aarch64enterprise_linux_for_ibm_z_systems = 8.0_s390xenterprise_linux_for_ibm_z_systems_eus = 8.8_s390xenterprise_linux_for_ibm_z_systems_eus_s390x = 9.2enterprise_linux_for_ibm_z_systems_s390x = 9.2enterprise_linux_for_power_little_endian = 8.0_ppc64leenterprise_linux_for_power_little_endian = 9.2_ppc64leenterprise_linux_for_power_little_endian_eus = 8.8_ppc64leenterprise_linux_for_power_little_endian_eus = 9.2_ppc64leenterprise_linux_server_aus = 9.2enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.2_ppc64leenterprise_linux_tus = 8.8fedora = 37fedora = 38fedora = 39Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-8674Medium· 5.3Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assert…
CVE-2026-77117Medium· 5.9Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to…
CVE-2026-80489Medium· 5.9Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to h…
CVE-2026-19542Medium· 5.6Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an expl…
CVE-2026-19499High· 7.7Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path tha…
CVE-2025-61662High· 7.8A Use-After-Free vulnerability has been discovered in GRUB's gettext module