GNU C Library CVE-2026-8674

Requires the glibc DNS stub resolver to initialize from an /etc/resolv.conf file or a LOCALDOMAIN environment variable whose search list contains a single domain of roughly 200 characters or more; affected glibc versions 2.26 through 2.44. The over-length search domain is the exact trigger. Remote (adjacent-network) exploitation is only feasible where search domains are populated from attacker-influenced DHCP or VPN configuration AND the intermediate network-configuration software does not validate/reject the over-length domain - this validation is the key limiting factor. Local exploitation additionally requires the ability to write the offending value to /etc/resolv.conf or set LOCALDOMAIN. Impact is limited to aborting the affected process (denial of service); no code execution, data disclosure, or integrity impact.

This is a genuine but bounded availability issue, not a high-priority emergency. The CVSS 3.1 base score of 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly reflects a denial-of-service with no confidentiality or integrity impact: a search-list domain of ~200+ characters trips a faulty consistency assertion (CWE-617) that aborts any process resolving names through glibc. Exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing and no weaponized POC, only a vendor Bugzilla entry, the official GLIBC-SA-2026-0021 advisory, a patch commit (506ea57), and a third-party fuzzing writeup (joshua.hu) that documents the class of bug rather than providing a working DoS exploit. No EPSS score was supplied, but the low CVSS, adjacent-network vector, high attack complexity, and DoS-only impact all point to low real-world exploitation likelihood. The realistic risk is indirect: search domains are frequently populated from DHCP or VPN-provided configuration, so an attacker controlling those channels could push an over-length search domain - but only 'subject to validation by the network configuration software,' which is the primary limiting factor and the reason the vendor assigned AC:H. Note a nuance in impact scoring: A:H denotes total loss of the affected process, which is accurate per-process, though the blast radius is a single crashing process (potentially a long-running daemon on its next resolv.conf reload) rather than the whole host.

An attacker on the same local network operates or spoofs a DHCP or VPN server and supplies a DNS search list containing a single domain of roughly 200 characters or more. When the victim's network-configuration software writes this into /etc/resolv.conf (or a LOCALDOMAIN value is set), the next stub-resolver initialization truncates the search list, hits the miscompared consistency assertion, and aborts the resolving process - crashing services or long-running daemons on their next query after the config reload. No public exploit code exists; success depends on the network-configuration software not validating the over-length domain.