gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response
CVE-2026-4437 has a selected CVSS score of 7.5 (high); EIP currently links 1 lab environment.
Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 23, 2026 · Source: CVE List
| Product | Source | Version range | Status |
|---|---|---|---|
SIMATIC S7-1500 CPU 1518-4 PN/DP MFPBrowse Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFPDefault status: unknown | CVE List | V3.1.5 to < V3.1.6 | affected |
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPBrowse Siemens / SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPDefault status: unknown | CVE List | V3.1.5 to < V3.1.6 | affected |
SIPLUS S7-1500 CPU 1518-4 PN/DP MFPBrowse Siemens / SIPLUS S7-1500 CPU 1518-4 PN/DP MFPDefault status: unknown | CVE List | V3.1.5 to < V3.1.6 | affected |
Default status: unaffected | CVE List | 2.34 to ≤ 2.43 | affected |
A source-built nginx 1.25.5 container image that remediates CVE-2024-6119 (OpenSSL version bump) and CVE-2026-42945 (backported source patch) while preserving upstream runtime behavior. The environment includes a Dockerfile, build scripts, patch files, regression tests, compatibility tests, and VEX generation scripts.
README.md:1-4Containerfile:1-84The README explicitly states the project remediates two CVEs (CVE-2024-6119 and CVE-2026-42945) and provides a test suite, patch provenance, and VEX generation to demonstrate the fixes. The Containerfile builds a custom nginx image with these remediations.
README.md:1-4README.md:7-10Defines the final nginx image based on debian:bookworm-slim, installs a custom-built .deb package, copies entrypoint scripts from the upstream nginx:1.25-bookworm image, and sets up log symlinks.
Containerfile:1-84Fetches nginx and NJS source tarballs with SHA256 verification, applies the CVE-2026-42945 patch, compiles nginx with upstream-identical configure flags, builds dynamic modules and debug binaries, and assembles a .deb package.
build/build.sh:1-925A one-line backported fix for CVE-2026-42945 that resets e->is_args in ngx_http_script_regex_end_code().
README.md:201-204Downloads upstream nginx source tarballs, verifies their integrity, generates a diff, and confirms the committed patch applies cleanly and matches the upstream fix.
build/verify-patch.sh:1-150Generates an OpenVEX v0.2.0 document declaring CVE-2026-42945 as fixed via backported patch, for use with vulnerability scanners.
build/generate-vex.sh:1-68Starts a container with a custom nginx config that exercises the vulnerable rewrite code path, sends HTTP requests that manipulate query string state, and asserts no crashes, buffer overflows, or malformed responses occur.
test/test_cve_2026_42945.py:1-446Boots both the baseline nginx:1.25-bookworm and the candidate fixed image, and compares image metadata, nginx -V output, dynamic modules, filesystem layout, HTTP responses, TLS termination, graceful shutdown, config reload, and concurrent request handling.
test/compat.py:1-930Insufficient evidence
Listed in the README residual risk table as a vulnerability in libldap-2.5-0 with status 'Won't fix'. No evidence of active remediation or exploitation is provided.
README.md:456-457Insufficient evidence
Listed in the README residual risk table as a vulnerability in nginx, noted as mitigated in nginx >= 1.25.3 but still flagged by scanners. No evidence of active remediation or exploitation is provided.
README.md:454-455Insufficient evidence
Mentioned in the README as an OpenSSL CVE fixed by the version bump to 3.0.20, but no specific evidence of the vulnerability or its remediation is provided beyond the general statement.
README.md:170-172Insufficient evidence
Mentioned in the README as an OpenSSL CVE fixed by the version bump to 3.0.20, but no specific evidence of the vulnerability or its remediation is provided beyond the general statement.
README.md:170-172Insufficient evidence
Mentioned in the README as an OpenSSL CVE fixed by the version bump to 3.0.20, but no specific evidence of the vulnerability or its remediation is provided beyond the general statement.
README.md:170-172Insufficient evidence
Mentioned in the README as an OpenSSL CVE fixed by the version bump to 3.0.20, but no specific evidence of the vulnerability or its remediation is provided beyond the general statement.
README.md:170-172Insufficient evidence
Mentioned in the README as an OpenSSL CVE fixed by the version bump to 3.0.20, but no specific evidence of the vulnerability or its remediation is provided beyond the general statement.
README.md:170-172Insufficient evidence
Mentioned in the README as an OpenSSL CVE fixed by the version bump to 3.0.20, but no specific evidence of the vulnerability or its remediation is provided beyond the general statement.
README.md:170-172Supported by supplied evidence
The README describes the remediation as a dependency version bump to libssl3 >= 3.0.14, enforced by the .deb package's Depends field. The Containerfile installs libssl3, and the build script declares the dependency. The README also notes that scanners no longer report this CVE.
README.md:7-8README.md:160-172Containerfile:28-30build/build.sh:1-4Insufficient evidence
Mentioned in the README as an OpenSSL CVE fixed by the version bump to 3.0.20, but no specific evidence of the vulnerability or its remediation is provided beyond the general statement.
README.md:170-172Insufficient evidence
Mentioned in the README as an OpenSSL CVE fixed by the version bump to 3.0.20, but no specific evidence of the vulnerability or its remediation is provided beyond the general statement.
README.md:170-172Insufficient evidence
Listed in the README residual risk table as a vulnerability in dpkg with status 'Fixable (upgrade to 1.21.23)'. No evidence of active remediation or exploitation is provided.
README.md:458-459Insufficient evidence
Mentioned in the README as an OpenSSL CVE fixed by the version bump to 3.0.20, but no specific evidence of the vulnerability or its remediation is provided beyond the general statement.
README.md:170-172Insufficient evidence
Listed in the README residual risk table as a vulnerability in ncurses with status 'Won't fix'. No evidence of active remediation or exploitation is provided.
README.md:460-461Insufficient evidence
Listed in the README residual risk table as a vulnerability in dpkg with status 'Fixable (upgrade to 1.21.23)'. No evidence of active remediation or exploitation is provided.
README.md:458-459Insufficient evidence
Listed in the README residual risk table as a vulnerability in libgnutls30 with status 'No fix available in bookworm'. No evidence of active remediation or exploitation is provided.
README.md:456-457Insufficient evidence
Listed in the README residual risk table as a vulnerability in libgnutls30 with status 'No fix available in bookworm'. No evidence of active remediation or exploitation is provided.
README.md:456-457Supported by supplied evidence
The README, build script, patch file, verification script, and regression test all provide evidence of a backported one-line fix from nginx 1.30.1. The build script applies the patch and verifies the fix marker; the verification script re-derives the patch from upstream tarballs; the regression test exercises the vulnerable code path without crashes.
README.md:7-10README.md:201-204build/build.sh:60-80build/verify-patch.sh:1-150test/test_cve_2026_42945.py:1-446Insufficient evidence
Listed in the README residual risk table as a vulnerability in libc6/libc-bin with status 'glibc won't-fix for bookworm'. No evidence of active remediation or exploitation is provided.
README.md:458-459Insufficient evidence
Listed in the README residual risk table as a vulnerability in libc6/libc-bin with status 'glibc won't-fix for bookworm'. No evidence of active remediation or exploitation is provided.
README.md:458-459Insufficient evidence
Listed in the README residual risk table as a vulnerability in libc6/libc-bin with status 'Won't fix in this Debian release'. No evidence of active remediation or exploitation is provided.
README.md:456-457Insufficient evidence
Listed in the README residual risk table as a vulnerability in curl/libcurl4 with status 'Won't fix'. No evidence of active remediation or exploitation is provided.
README.md:460-461Insufficient evidence
Listed in the README residual risk table as a vulnerability in libc6/libc-bin with status 'glibc won't-fix for bookworm'. No evidence of active remediation or exploitation is provided.
README.md:458-459Insufficient evidence
Listed in the README residual risk table as a vulnerability in curl/libcurl4 with status 'Won't fix'. No evidence of active remediation or exploitation is provided.
README.md:460-461README.md:53-55test/test_cve_2026_42945.py:180-185test/compat.py:1build/build.sh:30-35build/build.sh:40-45build/verify-patch.sh:30-35test/compat.py:40-41README.md:53-55README.md:56-57README.md:59-60README.md:62-63README.md:65-66All visible behavior is directed at building, testing, and verifying a patched nginx container image within the lab's own scope. The Containerfile, build scripts, and test suites do not contain any instructions that escape the container boundary, persist data outside the lab, steal credentials, or connect to external systems beyond documented source downloads. The regression test starts a container with a custom config and sends HTTP requests to localhost; the compatibility test compares two local containers. No hidden or unnecessary host compromise is evident.
Containerfile:1-84build/build.sh:1-925test/test_cve_2026_42945.py:1-446test/compat.py:1-930This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.