[PATCH 2/2] Add advisory text for CVE-2026-4438

[Carlos O'Donell]

Explain the security issue and set the context for the vulnerability to
help downstreams get a better understanding of the issue.
---
 advisories/GLIBC-SA-2026-0006 | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 advisories/GLIBC-SA-2026-0006

diff --git a/advisories/GLIBC-SA-2026-0006 b/advisories/GLIBC-SA-2026-0006
new file mode 100644
index 0000000000..9d81bb8093
--- /dev/null
+++ b/advisories/GLIBC-SA-2026-0006
@@ -0,0 +1,25 @@
+gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
+
+Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf
+that specifies the library's DNS backend in the GNU C library version
+2.34 to version 2.43 could result in an invalid DNS hostname being
+returned to the caller in violation of the DNS specification.
+
+A defect in the getanswer_ptr function, which implements the iteration
+and extraction of the answer from a DNS response, can cause it to accept
+an invalid DNS hostname that can contain shell metacharacters. An
+application that uses the returned hostname in a shell, without guarding
+for shell expansion, may be subject to shell injection attacks.  At the
+time of publication, no known affected DNS server returns results with
+shell metacharacters in the results.  An attacker would either need to
+be network adjacent or have compromised the DNS server to use this
+defect for shell injection.  No known vulnerable application has been
+identified. 
+
+CVE-Id: CVE-2026-4438
+Public-Date: 2026-03-19
+Vulnerable-Commit: 32e5db37684ffcbc6ae34fcc6cdcf28670506baa (2.34-323)
+Vulnerable-Commit: def97e7f71a07517810f7263213d607e08ad21f1 (2.35-188)
+Vulnerable-Commit: 77f523c473878ec0051582ef15161c6982879095 (2.36-30)
+Vulnerable-Commit: e32547d661a43da63368e488b6cfa9c53b4dcf92 (2.37)
+Reported-by: Antonio Maini (0rbitingZer0) - 0rbitingZer0@proton.me
-- 
2.53.0