{"id":"AZL-101843","summary":"CVE-2026-8674 affecting package glibc 2.38-21","details":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.","modified":"2026-09-18T14:15:32.135281865Z","published":"2026-09-17T17:16:53Z","upstream":["CVE-2026-8674"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674"}],"affected":[{"package":{"name":"glibc","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/glibc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.38-21"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-101843.json"}}],"schema_version":"1.9.0"}