CVE-2026-4437.toml

# glibc DNS resolver parses a crafted server response incorrectly.
# 5-Spot only resolves DNS names supplied via its kubeconfig (typically the
# in-cluster KUBERNETES_SERVICE_HOST env var or a service DNS name
# controlled by the cluster operator). A cluster-internal kube-dns /
# CoreDNS server is by definition not attacker-controlled in the threat
# model, so an adversary cannot supply the malformed response required to
# trigger this bug.
cve = "CVE-2026-4437"
status = "not_affected"
justification = "vulnerable_code_cannot_be_controlled_by_adversary"
impact_statement = "5-Spot only resolves names against the in-cluster DNS resolver configured by the platform operator; no adversary-controlled DNS path reaches the glibc resolver."
products = ["pkg:oci/5-spot"]
author = "erick.bourgeois@gmail.com"
timestamp = "2026-04-19T00:00:00Z"