Summary
The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.
Security Fix(es):
* dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)
* dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)
* dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)
* dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)
* dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)
* dnsmasq: extract_addresses() OOB read via malformed rdlen (CVE-2026-5172)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | dnsmasq | 0:2.90-7.el10_2 |
Vulnerabilities 6
-
High 8.4
CVE-2026-4892
A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet.
-
High 7.5
CVE-2026-4890
A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
-
High 7.3CVE-2026-2291 Public exploit
CVE-2026-2291
dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.
-
High 7.3CVE-2026-5172 Public exploit
CVE-2026-5172
A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the pointer past the record’s end.
-
Medium 5.3
CVE-2026-4891
A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
-
Medium 5.3CVE-2026-4893 Public exploit
CVE-2026-4893
An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information.
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2458517
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2439088
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2458521
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2458516
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2458519
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2458518