ZeroDay Findings
Sign inSign up

Findings

CVE-2018-19591

In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed

Published Dec 4, 2018 · updated Oct 15, 2026 · gnu glibc

In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 4, 2018 · NIST NVD

    Detected

    In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

  2. Oct 14, 2026 · NIST NVD

    Updated

    In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

  3. Oct 14, 2026 · OSV.dev

    Fix available

    glibc fixed in 2.28-1; glibc fixed in 2.28-1; glibc fixed in 2.28-1

  4. Oct 14, 2026 · OSV.dev

    Fix available

    glibc fixed in 2.28-1

  5. Oct 14, 2026 · OSV.dev

    Updated

    In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

  6. Oct 14, 2026 · OSV.dev

    Updated

    In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

  7. Oct 14, 2026 · OSV.dev

    Updated

    In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

  8. Oct 15, 2026 · OSV.dev

    Updated

    In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

Affected

  • Debian:12 glibc0 → 2.28-1
  • Debian:13 glibc0 → 2.28-1
  • Debian:14 glibc0 → 2.28-1
  • cpe fedoraproject/fedora28
  • cpe fedoraproject/fedora29
  • cpe gnu/glibcversion unspecified

Sources

  • CVE.orgCVE-2018-19591

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2018-19591

    30-day exploitation probability 5.5%

    first.org
  • NIST NVDCVE-2018-19591

    In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

    nvd.nist.gov
  • OSV.devDEBIAN-CVE-2018-19591
    osv.dev

References