Moderate Security Vulnerability in gawk: Memory Corruption and Denial of Service
Summary
ALSA-2026:73511: Moderate: gawk security update. Affects gawk versions < 4.2.1-5.el8_10. Fixed in 4.2.1-5.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gawk is the GNU implementation of the awk programming language, widely used for text processing and pattern matching. It allows users to manipulate data and generate reports with ease. However, recent vulnerabilities have been identified that could compromise its stability and security, making it crucial for users to stay informed and take action.
Vulnerability Detail
The vulnerabilities in gawk stem from memory corruption due to an integer overflow (CVE-2026-40468) and a Denial of Service (DoS) caused by a Use After Free issue in the io.c file (CVE-2026-40467). These vulnerabilities could allow an attacker to exploit the software, leading to potential crashes or unauthorized access to sensitive data.
How To Fix
Minimum fixed version
4.2.1-5.el8_10
This is the first release that contains the fix.
sudo dnf update gawkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the affected features of gawk until the package is updated. However, it is highly recommended to apply the update as soon as possible to mitigate risks.
Conclusion
The identified vulnerabilities in gawk pose significant risks that can lead to memory corruption and Denial of Service. It is essential for users to update to the latest patched version to ensure the security and stability of their systems.
See every vulnerability recorded for gawk →
FAQ
gawk is a text processing utility that interprets a programming language for pattern matching and data manipulation.
The vulnerabilities include memory corruption via integer overflow and a Denial of Service due to a Use After Free issue.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If an immediate update is not possible, avoid using the affected features of gawk as a temporary workaround.
More details can be found on the CVE pages listed in the references section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for gawk.
