Moderate Vulnerability in gawk Package: Memory Corruption and Buffer Overflow Issues
Summary
ALSA-2026:73429: Moderate: gawk security update. Affects gawk versions < 5.3.0-6.el10_2.1. Fixed in 5.3.0-6.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gawk package contains the GNU version of awk, a powerful text processing utility that interprets a specialized programming language for text pattern matching and reformatting tasks. It is widely used in various applications for its efficiency and flexibility in handling text data. However, recent security findings have revealed vulnerabilities that could compromise its integrity and lead to severe consequences.
Vulnerability Detail
The vulnerabilities in the gawk package stem from memory corruption via integer overflow, a buffer overflow in the ftype() routine, and a use-after-free issue in io.c. These vulnerabilities can lead to code execution, denial of service, and potential exploitation by malicious actors. The specific CVEs associated with these vulnerabilities are CVE-2026-40467, CVE-2026-40468, and CVE-2026-40553, which highlight the critical nature of these issues and their potential impact on systems utilizing gawk.
How To Fix
Minimum fixed version
5.3.0-6.el10_2.1
This is the first release that contains the fix.
sudo dnf update gawkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the affected functionalities of gawk until the package is updated. It is advisable to limit the use of scripts that rely on gawk for critical operations until the vulnerabilities are addressed.
Conclusion
The gawk package has been identified with moderate vulnerabilities that could lead to significant security risks. It is crucial for users to update to the latest patched version to ensure the integrity and security of their systems. Regular monitoring of vulnerabilities using tools like Vulert can help maintain a secure software environment.
See every vulnerability recorded for gawk →
FAQ
Gawk is the GNU implementation of the awk programming language, used for pattern scanning and processing.
The vulnerabilities can lead to memory corruption, buffer overflow, and denial of service, potentially allowing attackers to execute arbitrary code.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signing up.
Yes, a patched version of gawk (5.3.0-6.el10_2.1) is available. Users should update to this version to mitigate the vulnerabilities.
If immediate updates are not possible, avoid using gawk for critical tasks and monitor for updates regularly.
Related vulnerabilities
Recent vulnerabilities recorded for gawk.
