GL
Product
Glibc
On CISA KEVExploited in the wild
163
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 22High 47Medium 31Low 2
Watch
Add Glibc to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-6238 | 6.5 | Apr 28 | Buffer overread in ns_printrrf with corrupted RDATA field Affected: 2.2 and later |
| CVE-2023-4527 | 6.5 | Sep 18 | Glibc: stack read overflow in getaddrinfo in no-aaaa mode Affected: 2.36 before 2.36.113; 2.37 before 2.37.38; 2.38 before 2.38.19 |
| CVE-2026-3904 | 6.2 | Mar 11 | Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client… Affected: 2.35 before 2.37 |
| CVE-2011-5320 | 6.2 | Oct 18 | scanf and related functions in glibc before 2.15 allow local users to cause a denial of service (segmentation fault) via a large string of 0s Affected: through 2.14.1 |
| CVE-2024-33600 | 5.9 | May 6 | nscd: Null pointer crashes after notfound response Affected: 2.15 before 2.40 |
| CVE-2023-4806 | 5.9 | Sep 18 | Glibc: potential use-after-free in getaddrinfo() Affected: 2.33 |
| CVE-2023-4813 | 5.9 | Sep 12 | Glibc: potential use-after-free in gaih_inet() Affected: before 2.36 |
| CVE-2019-25013 | 5.9 | Jan 4 | The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read Affected: through 2.32 |
| CVE-2017-15671 | 5.9 | Oct 20 | The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when processing the ~ operator… Affected: through 2.26 |
| CVE-2017-12133 | 5.9 | Sep 7 | Use-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) before 2.26 allows remote attackers to have unspecified… Affected: through 2.25 |
| CVE-2017-12132 | 5.9 | Aug 1 | The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially… Affected: through 2.25 |
| CVE-2015-8985 | 5.9 | Mar 20 | The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via… Affected: before 2.28 |
| CVE-2015-8984 | 5.9 | Mar 20 | The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash) via a malformed… Affected: through 2.21 |
| CVE-2016-10228 | 5.9 | Mar 2 | The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the… Affected: through 2.25 |
| CVE-2016-4429 | 5.9 | Jun 10 | Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash)… Affected: before 2.24 |
| CVE-2025-5745 | 5.6 | Jun 5 | The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 to v31 without saving contents from the… Affected: 2.40 before 2.40-136; 2.41 before 2.41-57 |
| CVE-2025-5702 | 5.6 | Jun 5 | The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the… Affected: 2.39 before 2.39-209; 2.40 before 2.40-139; 2.41 before 2.41-60 |
| CVE-2015-20109 | 5.5 | Jun 25 | end_pattern (called from internal_fnmatch) in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application… Affected: before 2.22 |
| CVE-2020-27618 | 5.5 | Feb 26 | The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and… Affected: through 2.32 |
| CVE-2020-10029 | 5.5 | Mar 4 | The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical… Affected: before 2.32.0 |
| CVE-2006-7254 | 5.5 | Apr 10 | The nscd daemon in the GNU C Library (glibc) before version 2.5 does not close incoming client sockets if they cannot be handled by the daemon, allowing local users to carry out a… Affected: before 2.5 |
| CVE-2019-7309 | 5.5 | Feb 3 | In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the… Affected: through 2.29 |
| CVE-2015-8777 | 5.5 | Jan 20 | The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero… Affected: through 2.22 |
| CVE-2026-4438 | 5.4 | Mar 20 | gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames Affected: 2.34 through 2.43 |
| CVE-2019-1010023 | 5.4 | Jul 15 | GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file Affected: All versions, or not specified |
| CVE-2023-6780 | 5.3 | Jan 31 | Glibc: integer overflow in __vsyslog_internal() Affected: 2.37 before 2.39 |
| CVE-2022-39046 | 5.3 | Aug 31 | An issue was discovered in the GNU C Library (glibc) 2.36 Affected: 2.36 |
| CVE-2019-1010025 | 5.3 | Jul 15 | GNU Libc current is affected by: Mitigation bypass Affected: All versions, or not specified |
| CVE-2019-1010024 | 5.3 | Jul 15 | GNU Libc current is affected by: Mitigation bypass Affected: All versions, or not specified |
| CVE-2016-10739 | 5.3 | Jan 21 | In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and… Affected: through 2.28 |
| CVE-2020-29562 | 4.8 | Dec 4 | The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and… Affected: 2.30 through 2.32 |
Showing 31