Hi,

The following vulnerability was published for glibc.

CVE-2026-8674[0]:
| Initializing the DNS stub resolver from an /etc/resolv.conf file, or
| a LOCALDOMAIN environment variable, whose search list contains a
| domain of roughly 200 characters or more in the GNU C Library
| version 2.26 to 2.44 results in an assertion failure which aborts
| the process.  The resolver truncates the search list when copying it
| into the fixed-size _res.defdname buffer, then asserts that the copy
| is consistent with the full configuration.  The consistency check
| compared against the wrong size and did not handle a first entry
| that does not fit, so a correctly truncated list failed the
| assertion.  Any process that resolves names through the library is
| affected, including long-running processes that reload
| /etc/resolv.conf on the next query after it changes.  Search domains
| are commonly written to /etc/resolv.conf from data received over
| DHCP or from a VPN server, so an attacker on the local network may
| be able to trigger this without privileges on the target system,
| subject to validation by the network configuration software.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-8674
https://www.cve.org/CVERecord?id=CVE-2026-8674
[1] https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0021
[2] https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a

Please adjust the affected versions in the BTS as needed.

Rgards,
Salvatore