CVE-2026-8674

A flaw was found in the GNU C Library (glibc) DNS stub resolver. This vulnerability allows a remote attacker on the local network to cause a denial of service by providing a specially crafted, excessively long search domain. When the resolver attempts to initialize with this long domain from /etc/resolv.conf or the LOCALDOMAIN environment variable, it triggers an assertion failure, which aborts the process. This can be exploited without privileges on the target system, potentially through network configuration mechanisms like DHCP or a VPN server.

A flaw of MODERATE severity was found in the glibc (GNU C Library) DNS stub resolver, affecting Red Hat Enterprise Linux 8, 9, and 10, Red Hat OpenShift Container Platform releases built on RHEL CoreOS, and Red Hat Hardened Images. Initializing the stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more triggers an assertion failure that aborts the process, causing a denial of service. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Because search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software; confidentiality and integrity are not impacted. Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support (both glibc and compat-glibc) are not affected because the vulnerable code, introduced upstream in glibc 2.26, is not present in those versions. For the primary supported Red Hat Enterprise Linux update streams and Red Hat Hardened Images, fixes are being pursued through the responsible product streams. For the OpenShift Container Platform (RHCOS-based) streams and certain older Red Hat Enterprise Linux minor streams, the fix is deferred because the impact is MODERATE with a CVSS 3.1 score of 5.3, below the threshold at which Red Hat files updates for those streams; the residual risk is that an adjacent-network attacker able to influence resolver configuration could crash name-resolving processes on affected hosts. Red Hat's severity assessment matches the upstream rating (CVSS 3.1 score 5.3, MODERATE).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.