CVE-2023-4806 — Glibc: potential use-after-free in getaddrinfo()
A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.
Who exploits it and how urgent it is
A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.
How the score was calculated
- EPSS 1.6% (30-day exploitation probability)+11
- Technical severity (medium)+3
The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.
CISA SSVC assessment CISA
Three decision points CISA publishes for the CVEs it assesses (SSVC 2.0.3). A stakeholder decision, not a severity score.
Remediation
Fixes and mitigations documented by the sources — linked to the original advisory.
No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.
First 24 hours
Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.
- Identify exposed assets running the affected vendor/product/version combinations (Fedoraproject Fedora, Gnu Glibc, Red Hat Codeready Linux Builder Eus…).
- The attack is network-based and needs no privileges: restrict exposure (ACLs, VPN, WAF) until patched.
- No fix documented in the sources: reduce exposure and monitor the vendor advisory.
- Search available logs for exploit probes matching the vulnerability class (memory corruption), errors and authentication anomalies.
Affected scope
Vendor, product and versions as the sources word them.
| Vendor | Product | Versions | Status | Source |
|---|---|---|---|---|
| Fedoraproject | Fedora | version 38version 39version 37 | Vulnerable | NIST National Vulnerability Database |
| Gnu | Glibc | version 2.33 | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Codeready Linux Builder Eus | version 9.2 | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Codeready Linux Builder Eus For Power Little Endian | version 9.0_ppc64le | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Codeready Linux Builder Eus For Power Little Endian Eus | version 9.2_ppc64le | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Codeready Linux Builder For Arm64 | version 9.0_aarch64 | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Codeready Linux Builder For Arm64 Eus | version 9.2_aarch64 | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Codeready Linux Builder For Ibm Z Systems | version 9.0_s390x | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Codeready Linux Builder For Ibm Z Systems Eus | version 9.2_s390x | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Enterprise Linux | version 7.0version 8.0version 9.0 | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Enterprise Linux Eus | version 9.2version 8.8 | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Enterprise Linux For Arm 64 | version 9.0_aarch64 | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Enterprise Linux For Arm 64 Eus | version 9.2_aarch64 | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Enterprise Linux For Ibm Z Systems | version 8.0_s390x | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Enterprise Linux For Ibm Z Systems Eus | version 8.8_s390x | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Enterprise Linux For Ibm Z Systems Eus S390x | version 9.2 | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Enterprise Linux For Ibm Z Systems S390x | version 9.2 | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Enterprise Linux For Power Little Endian | version 8.0_ppc64leversion 9.2_ppc64le | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Enterprise Linux For Power Little Endian Eus | version 8.8_ppc64leversion 9.2_ppc64le | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Enterprise Linux Server Aus | version 9.2 | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions | version 9.2_ppc64le | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Enterprise Linux Tus | version 8.8 | Vulnerable | NIST National Vulnerability Database |
| Red Hat | Red Hat Enterprise Linux 7 | versions not specified by the source | Vulnerable | CVE Program (cve.org) e CISA ADP |
| Red Hat | Red Hat Enterprise Linux 8 | versions not specified by the source | Vulnerable | CVE Program (cve.org) e CISA ADP |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | versions not specified by the source | Vulnerable | CVE Program (cve.org) e CISA ADP |
| Red Hat | Red Hat Enterprise Linux 9 | versions not specified by the source | Vulnerable | CVE Program (cve.org) e CISA ADP |
| Red Hat | Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 | versions not specified by the source | Vulnerable | CVE Program (cve.org) e CISA ADP |
Attack characteristics
The CVSS vector, decoded. It describes the attack, not your exposure to it.
Every base score collected
Sources score independently and may disagree; each row says who scored it and under which version.
| Score | Version | Severity | Expl. | Impact | Scored by |
|---|---|---|---|---|---|
| 5.9 | CVSS 3.1 | Medium | 2.2 | 3.6 | secalert@redhat.com via NIST National Vulnerability Database |
| 5.9 | CVSS 3.1 | Medium | 2.2 | 3.6 | nvd@nist.gov via NIST National Vulnerability Database |
| 5.9 | CVSS 3.1 | Medium | — | — | GitHub, Inc. via GitHub Security Advisories |
| 5.9 | CVSS 3.1 | Medium | — | — | redhat via CVE Program (cve.org) e CISA ADP |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (score shown at the top: nvd@nist.gov) Weakness MITRE
Weakness class according to MITRE’s CWE catalog.
Detection
Read off the CVSS vector and the weakness class. Starting points, not tested rules.
- Prioritize edge telemetry for the network-reachable component (proxy, WAF, IDS/IPS).
- Correlate service crashes/restarts with inbound traffic; repeated crashes may indicate attempts.
Timeline
What happened to this CVE, newest first.
- 2026
- Affected products added · red hat/red hat enterprise linux 8, red hat/red hat enterprise linux 8.6 extended update support, red hat/red hat enterp
- SSVC assessment updated
- Record published
- Affected products added · gnu/glibc, redhat/codeready linux builder eus, redhat/codeready linux builder eus for power little endian, redhat/codere
- CVSS changed · 5.9
- Source status changed · → Modified
- Record created in this database
- 2023
- CVE published
Source activity
Repeated readings are counted rather than listed.
- 2× References added · Oct 14, 2026 – Oct 14, 2026
- 1× Official description updated · Oct 14, 2026 – Oct 14, 2026
References
23 on the record
- nvd.nist.gov/vuln/detail/CVE-2023-4806
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFG4P7
- security.gentoo.org/glsa/202310-03
- bugzilla.redhat.com/show_bug.cgi
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAQWH
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAQWH
- www.openwall.com/lists/oss-security/2023/10/03/4
- github.com/advisories/GHSA-5f52-v49r-796w
- access.redhat.com/errata/RHBA-2024:2413
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFG4P7
- access.redhat.com/errata/RHSA-2023:5455
- www.openwall.com/lists/oss-security/2023/10/03/5
- cert-portal.siemens.com/productcert/html/ssa-831302.html
- security.netapp.com/advisory/ntap-20240125-0008
- security.netapp.com/advisory/ntap-20240125-0008/
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DBUQR
- access.redhat.com/errata/RHSA-2023:5453
- access.redhat.com/security/cve/CVE-2023-4806
- cert-portal.siemens.com/productcert/html/ssa-082556.html
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DBUQR
- www.openwall.com/lists/oss-security/2023/10/03/8
- access.redhat.com/errata/RHSA-2023:7409
- www.openwall.com/lists/oss-security/2023/10/03/6
Elsewhere on this site
Related CVEs (same products)
- Medium CVE-2026-110924 Openssh: openssh: gssapi delegated credentials can be stored after a failed authentication 10h
- Medium CVE-2026-110927 Openssh: openssh: a compressed payload can expand past the maximum packet size 10h
- Medium CVE-2026-110926 Openssh: openssh: shared lz77 compression dictionary leaks plaintext across channels 18h
- Medium CVE-2026-110923 Openssh: openssh: sftp can write outside the destination directory from a server-supplied path 18h
- Medium CVE-2026-110925 Openssh: openssh: '$' and '\' in a command-line username expand through %u 18h
- High CVE-2026-86848 Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto 1d
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No fixed version, patch or mitigation documented.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.
Answered from this record
Text assembled only from the fields above — no additional claims.
What should defenders know first?
CVE-2023-4806 is "Glibc: potential use-after-free in getaddrinfo()", rated Medium. It affects Fedora (Fedoraproject); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. CVSS 5.9 describes technical severity. EPSS 1.61% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.
Comments
Moderated technical discussion. Read the community guidelines.
No comments yet.
Sign in or create an account to comment and suggest corrections.