In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed

Timeline

Detection, updates, and resolution for this record.

1. Dec 4, 2018 · NIST NVD

   Detected

   In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

2. Oct 14, 2026 · NIST NVD

   Updated

   In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

3. Oct 14, 2026 · OSV.dev

   Fix available

   glibc fixed in 2.28-1; glibc fixed in 2.28-1; glibc fixed in 2.28-1

4. Oct 14, 2026 · OSV.dev

   Fix available

   glibc fixed in 2.28-1

5. Oct 14, 2026 · OSV.dev

   Updated

   In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

6. Oct 14, 2026 · OSV.dev

   Updated

   In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

7. Oct 14, 2026 · OSV.dev

   Updated

   In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

8. Oct 15, 2026 · OSV.dev

   Updated

   In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

Affected

• Debian:12 glibc0 → 2.28-1
• Debian:13 glibc0 → 2.28-1
• Debian:14 glibc0 → 2.28-1
• cpe fedoraproject/fedora28
• cpe fedoraproject/fedora29
• cpe gnu/glibcversion unspecified

Sources

• CVE.orgCVE-2018-19591

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2018-19591

  30-day exploitation probability 5.5%

  first.org
• NIST NVDCVE-2018-19591

  In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

  nvd.nist.gov
• OSV.devDEBIAN-CVE-2018-19591
  osv.dev

References

• Third Party Advisory · securityfocus.com
• Third Party Advisory · securitytracker.com
• Reference · lists.fedoraproject.org
• Reference · lists.fedoraproject.org
• ADVISORY · security-tracker.debian.org
• Third Party Advisory · security.gentoo.org
• Reference · security.gentoo.org
• Reference · security.netapp.com
• Exploit · sourceware.org