CVE-2026-4438.toml

# glibc gethostbyaddr() returns an invalid hostname on crafted input.
# 5-Spot never calls gethostbyaddr / gethostbyname_r. The hostname crate
# (v0.4.2) uses the gethostname(2) syscall to read the local host name and
# does not perform reverse DNS. No reverse-DNS lookups occur in the
# controller or its dependencies.
cve = "CVE-2026-4438"
status = "not_affected"
justification = "vulnerable_code_cannot_be_controlled_by_adversary"
impact_statement = "5-Spot performs no reverse DNS lookups; gethostbyaddr is never invoked and no attacker-controlled address can reach the vulnerable code."
products = ["pkg:oci/5-spot"]
author = "erick.bourgeois@gmail.com"
timestamp = "2026-04-19T00:00:00Z"