Moderate Vulnerability in gawk: Memory Corruption and Denial of Service Risks
Summary
RLSA-2026:73511: Moderate: gawk security update. Affects gawk versions < 0:4.2.1-5.el8_10. Fixed in 0:4.2.1-5.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gawk package is the GNU implementation of the awk programming language, widely used for text processing and pattern matching. It allows users to perform complex text manipulations efficiently. However, recent vulnerabilities have been identified that could compromise the integrity and availability of systems using this utility.
Vulnerability Detail
The vulnerabilities in gawk stem from a memory corruption issue due to an integer overflow (CVE-2026-40468) and a Denial of Service (DoS) vulnerability caused by a Use After Free error in the io.c file (CVE-2026-40467). These vulnerabilities can lead to unexpected behavior, including crashes or unauthorized access to sensitive data, thereby affecting the reliability of applications relying on gawk for text processing.
How To Fix
Minimum fixed version
0:4.2.1-5.el8_10
This is the first release that contains the fix.
sudo dnf update gawkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using gawk for critical text processing tasks until the package is updated. Additionally, consider using alternative text processing tools such as sed or Perl until the vulnerabilities are patched.
Conclusion
The gawk package has been identified with moderate vulnerabilities that could lead to memory corruption and Denial of Service. It is crucial for users to update to the patched version to ensure system integrity and reliability. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for gawk →
FAQ
The vulnerabilities include a memory corruption issue due to integer overflow and a Denial of Service vulnerability caused by a Use After Free error.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 4.4, indicating a moderate severity level.
If an immediate update is not possible, consider using alternative text processing tools or avoid using gawk for critical tasks.
For more details, refer to the CVE pages listed in the references section of the vulnerability report.
References
Related vulnerabilities
Recent vulnerabilities recorded for gawk.
