DNS domain search list followed for extant domain missing A or AAAA records

How it was found

Summary:

Curl calls getaddrinfo to resolve a domain's addresses, however glibc will continue though the domain search list to find data even if it gets a NODATA response. When using AF_UNSPEC in the ai_hints, this search will stop at the first domain with either an A or AAAA record, however when using AF_INET or AF_INET6, the search will continue until an address of the specified type is found. This was encountered by someone who had a wildcard subdomain for one of the domains in their search list (https://discourse.nixos.org/t/0a000410-ssl-routines-ssl-error-only-in-nix-sandbox/78015/3).

I apologize if glibc is a better location for this report considering their handling of NODATA (not NXDOMAIN) responses (https://sourceware.org/git/?p=glibc.git;a=blob;f=resolv/res_query.c;h=30ace9d06dcd7fe938df29a654643b656725de9f;hb=HEAD#l481).

Affected version

curl 8.20.0 (x86_64-pc-linux-gnu) libcurl/8.20.0 OpenSSL/3.6.2 zlib/1.3.2 brotli/1.2.0 zstd/1.5.7 libidn2/2.3.8 libpsl/0.21.5 libssh2/1.11.1 nghttp2/1.69.0 ngtcp2/1.22.1 nghttp3/1.15.0 mit-krb5/1.22.1 Release-Date: 2026-04-29 Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt mqtts pop3 pop3s rtsp scp sftp smtp smtps telnet tftp Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Kerberos Largefile libz PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd

Steps To Reproduce:

Disable nscd and try to connect to an IPv4 only host (e.g. github.com) where an AAAA record exists for a domain in the search list (e.g. github.com.home.arpa). If curl can connect to the IPv6 address for github.com.home.arpa, it will prefer it over the IPv4 address for github.com.

Again: there is no bug-bounty for curl. We do not offer any rewards, only proper credits.

Impact

Summary:

An attacker in control of part or all of a domain on a computer's domain search list can intercept and block traffic to IPv4 only hosts. This does not affect certificate validation so TLS traffic can't be decrypted.