Threats Tagged 'oesa-2026-4016'

CVE-2026-8674 is a reachable assertion vulnerability in the GNU C Library (glibc) affecting versions 2.26 through 2.44. It occurs when the DNS stub resolver initializes from an /etc/resolv.conf file or LOCALDOMAIN environment variable with a search list containing a domain roughly 200 characters or longer. This triggers an assertion failure that aborts the process. The flaw arises because the resolver truncates the search list into a fixed-size buffer but performs a consistency check against the wrong size, causing a valid truncated list to fail the assertion. Any process performing name resolution via glibc is affected, including long-running processes that reload /etc/resolv.conf after changes. Attackers on the local network may trigger this without privileges, leveraging DHCP or VPN server configurations that update search domains.