Moderate Vulnerability in gawk Package: Memory Corruption and Buffer Overflow Issues
Summary
RLSA-2026:73429: Moderate: gawk security update. Affects gawk versions < 0:5.3.0-6.el10_2.1. Fixed in 0:5.3.0-6.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gawk package is the GNU implementation of awk, a powerful text processing utility widely used for pattern matching and data manipulation in scripts. It allows users to perform complex text transformations and data extraction tasks efficiently. However, recent security vulnerabilities have been identified that could compromise the integrity and availability of systems using this package.
Vulnerability Detail
The vulnerabilities in gawk include a memory corruption issue due to an integer overflow (CVE-2026-40468), a buffer overflow in the ftype() routine that may lead to code execution or denial of service (CVE-2026-40553), and a denial of service caused by a use-after-free vulnerability in io.c (CVE-2026-40467). These vulnerabilities can be exploited by attackers to execute arbitrary code, crash the application, or cause unexpected behavior, posing significant risks to system security.
How To Fix
Minimum fixed version
0:5.3.0-6.el10_2.1
This is the first release that contains the fix.
sudo dnf update gawkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of gawk in critical applications until the package is updated. Additionally, running gawk in a controlled environment or sandbox can help mitigate potential risks while waiting for the patch.
Conclusion
The gawk package has been identified with several vulnerabilities that could potentially compromise system security. It is crucial for users to update to the latest version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for gawk →
FAQ
Gawk is the GNU implementation of the awk programming language, used for text processing and data extraction.
The main vulnerabilities include memory corruption, buffer overflow, and denial of service issues that can lead to code execution or application crashes.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signing up.
The CVSS score of the vulnerabilities in gawk is 6.2, indicating a moderate level of severity.
You can update the gawk package by running 'sudo yum update gawk' in your terminal to install the latest patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for gawk.
