Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
Apache HTTP Server: Unsecured Data Exposure via DNS Response
published 3 months ago
Summary
The Apache HTTP Server's dependency on glibc has a vulnerability that could allow an attacker to access sensitive information or crash the server by sending a malicious DNS response. This could potentially expose your website's data or disrupt service. You should update your glibc packages to the latest version to fix this issue.
What to do
- Update rocky glibc to version 0:2.39-128.el10_2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:10 | rocky | glibc |
< 0:2.39-128.el10_2 Fix: upgrade to 0:2.39-128.el10_2
|
Original advisory text
Moderate: glibc security update
The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.
Security Fix(es):
* glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928)
* glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)
* glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928)
* glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435)
* glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:42694 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2463539 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2459854 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2463465 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published22 Jul 2026
Updated22 Jul 2026
First seen22 Jul 2026
Sources
RLSA-2026:42694 · OSV
Track software like this
Free during beta