Skip to main content

DNS CVE-2026-0915

HIGH
Use of Uninitialized Resource (CWE-908)
2026-01-15 3ff69d7a-14f2-4f67-a097-88dee7810d18
DNS Red Hat Glibc Suse Gnu
7.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Configure nsswitch.conf with DNS backend
  2. Exploit
    Call getnetbyaddr with zero-valued network
  3. Execution
    Trigger stack memory leak
  4. Impact
    Exfiltrate sensitive data to DNS resolver

Vulnerability Assessment

Weakness
CWE
CWE-908
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
Exploitation Conditions

nsswitch.conf must specify DNS backend for networks database; getnetbyaddr or getnetbyaddr_r function must be called with a zero-valued network query; GNU C Library versions 2.0 through 2.42 must be installed.
Impact

CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitable via remote/network.
Exploit ScenarioDerived

A remote attacker could exploit this vulnerability to compromise the affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Stack memory disclosure in GNU C Library versions 2.0-2.42 allows unauthenticated remote attackers to leak sensitive stack contents via crafted DNS queries when getnetbyaddr functions are configured to use the DNS backend for network lookups. This vulnerability affects systems running vulnerable Glibc and DNS resolver combinations, with no available patch currently released.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:54 CVSS 7.5

Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver. [CVSS 7.5 HIGH]

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-908 (Use of Uninitialized Resource). Affects Glibc. Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.

Know when DNS gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SUSE HIGH
Red Hat 5.3 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Patch released
Apr 09, 2026 - 14:30 nvd
Patch available
CVE Published
Jan 15, 2026 - 22:16 nvd
HIGH 7.5

DescriptionCVE.org

Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.

Executive ViewAI

Why It Matters

Organizations using the GNU C Library face notable risk from CVE-2026-0915 rated CVSS 7.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Affected Products (CPE)CVE.org

cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*

More in DNS

View all
CVE-2026-24054 CRITICAL POC
10.0 Jan 29

Sandbox escape in Kata Containers allowing guest VM to access host resources. CVSS 10.0 — undermines the core security g
CVE-2019-25361 CRITICAL POC
9.8 Feb 18

Buffer overflow in Ayukov NFTP client 1.71 in SYST command handling allows remote FTP servers to execute arbitrary code

CVE-2019-25327 CRITICAL POC
9.8 Feb 12

Buffer overflow in Prime95 29.8 build 6 user ID field allows code execution. PoC available.
CVE-2019-25319 CRITICAL POC
9.8 Feb 12

Stack overflow in Domain Quester Pro 6.02 via SEH overwrite. PoC available.
CVE-2020-37095 CRITICAL POC
9.8 Feb 07

Cyberoam Authentication Client 2.1.2.7 has a buffer overflow allowing remote attackers to execute code through the netwo
CVE-2021-47774 CRITICAL POC
9.8 Jan 15

Kingdia CD Extractor 3.0.2 has a buffer overflow in the registration name field. PoC available.
CVE-2021-47785 CRITICAL POC
9.8 Jan 16

Ether MP3 CD Burner 1.3.8 has buffer overflow in registration enabling bind shell on port 3110 via SEH overwrite. PoC av
CVE-2019-25362 CRITICAL POC
9.8 Feb 18

Buffer overflow in WMV to AVI MPEG DVD Convertor 4.6.1217 allows code execution via crafted media files. PoC available.
CVE-2020-37119 CRITICAL POC
9.8 Feb 05

Stack-based buffer overflow in Nsauditor Network Auditing Tool 3.0.28 and 3.2.1.0 in the DNS Lookup tool allows attacker
CVE-2026-2186 HIGH POC
8.8 Feb 08

Stack-based buffer overflow in Tenda RX3 firmware 16.03.13.11 allows authenticated remote attackers to achieve full syst
CVE-2026-3379 HIGH POC
8.8 Mar 01

Remote code execution in Tenda F453 1.0.0.3 DNS firmware via a buffer overflow in the /goform/SetIpBind endpoint allows

CVE-2019-25318 HIGH POC
8.8 Feb 12

AVS Audio Converter 9.1.2.600 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container private-registry/harbor-core:1.1.1-1.24 Container private-registry/harbor-exporter:1.1.1-1.24 Container private-registry/harbor-jobservice:1.1.1-1.24 Container private-registry/harbor-portal:1.1.1-1.25 Container private-registry/harbor-registry:1.1.1-1.24 Container private-registry/harbor-registryctl:1.1.1-1.24 Container private-registry/harbor-trivy-adapter:1.1.1-1.27 Container suse/manager/5.0/x86_64/proxy-httpd:latest Container suse/manager/5.0/x86_64/proxy-salt-broker:latest Container suse/manager/5.0/x86_64/proxy-squid:latest Container suse/manager/5.0/x86_64/proxy-ssh:latest Container suse/manager/5.0/x86_64/proxy-tftpd:latest Container suse/manager/5.0/x86_64/server-attestation:latest Container suse/manager/5.0/x86_64/server-hub-xmlrpc-api:latest Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:5.1.2.8.15.2 Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.2.9.13.2 Container suse/multi-linux-manager/5.1/x86_64/proxy-squid:5.1.2.8.13.1 Container suse/multi-linux-manager/5.1/x86_64/proxy-ssh:5.1.2.8.13.1 Container suse/multi-linux-manager/5.1/x86_64/proxy-tftpd:5.1.2.8.13.1 Container suse/multi-linux-manager/5.1/x86_64/server-attestation:5.1.2.8.15.2 Container suse/multi-linux-manager/5.1/x86_64/server-hub-xmlrpc-api:5.1.2.8.13.1 Container suse/multi-linux-manager/5.1/x86_64/server-saline:5.1.2.9.13.1 Image pr_15_7 Image proxy-httpd-image Image proxy-salt-broker-image Image proxy-squid-image Image proxy-ssh-image Image proxy-tftpd-image Image server-attestation-image Image server-hub-xmlrpc-api-image Image server-migration-14-16-image Image server-saline-image Affected
Container rancher/elemental-channel/sl-micro:6.0-baremetal Container rancher/elemental-channel/sl-micro:6.0-base Container rancher/elemental-channel/sl-micro:6.0-kvm Container rancher/elemental-channel/sl-micro:6.0-rt Container suse/sl-micro/6.0/baremetal-iso-image:2.1.4-6.124 Container suse/sl-micro/6.0/base-iso-image:2.1.4-5.124 Container suse/sl-micro/6.0/kvm-iso-image:2.1.4-6.130 Container suse/sl-micro/6.0/rt-iso-image:2.1.4-6.125 Container suse/sl-micro/6.1/baremetal-iso-image:2.2.1-5.70 Container suse/sl-micro/6.1/base-iso-image:2.2.1-5.86 Container suse/sl-micro/6.1/kvm-iso-image:2.2.1-5.97 Container suse/sl-micro/6.1/rt-iso-image:2.2.1-5.74 Affected
Container suse/ltss/sle12.5/sles12sp5:8.5.203 Affected
Container suse/manager/4.3/proxy-httpd:4.3.16.2.9.73.23 Container suse/manager/4.3/proxy-salt-broker:4.3.16.2.9.63.24 Container suse/manager/4.3/proxy-squid:4.3.16.2.9.72.18 Container suse/manager/4.3/proxy-ssh:4.3.16.2.9.63.17 Container suse/manager/4.3/proxy-tftpd:4.3.16.2.9.63.18 Affected
Container suse/manager/5.0/x86_64/server-migration-14-16:latest Container suse/multi-linux-manager/5.1/x86_64/server-migration-14-16:5.1.2.8.13.1 Container suse/multi-linux-manager/5.1/x86_64/server-postgresql:5.1.2.6.13.1 Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image server-database-migration-image Image server-postgresql-image Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:1334 ADVISORY https://access.redhat.com/errata/RHSA-2026:2786 ADVISORY https://access.redhat.com/errata/RHSA-2026:3228 ADVISORY https://access.redhat.com/errata/RHSA-2026:4501 ADVISORY https://access.redhat.com/errata/RHSA-2026:4655 ADVISORY https://access.redhat.com/errata/RHSA-2026:4772 ADVISORY https://access.redhat.com/errata/RHSA-2026:4943 ADVISORY https://access.redhat.com/errata/RHSA-2026:5606 ADVISORY https://vuldb.com/?id.341463 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0371/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0680/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0896/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20178/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20198/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20527/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20536/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20563/ REF http://www.openwall.com/lists/oss-security/2026/01/16/6 REF https://sourceware.org/bugzilla/show_bug.cgi?id=33802

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy