Summary
Yiwei Hou discovered that Dnsmasq incorrectly handled logging of DS or
DNSKEY. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2026-12725)
It was discovered that Dnsmasq incorrectly validated the length of
fixed-length DNS record fields when parsing NS section records. A remote
attacker could possibly use this issue to cause Dnsmasq to read out of
bounds, possibly exposing sensitive information. (CVE-2026-12969)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | dnsmasq | 2.90-0ubuntu0.22.04.4 |
| Ubuntu · 24.04 LTS 24.04:LTS | dnsmasq | 2.90-2ubuntu0.4 |
| Ubuntu · 26.04 LTS 26.04:LTS | dnsmasq | 2.92-1ubuntu0.4 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | dnsmasq | 2.90-0ubuntu0.16.04.1+esm4 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | dnsmasq | 2.90-0ubuntu0.18.04.1+esm4 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | dnsmasq | 2.90-0ubuntu0.20.04.1+esm3 |
Vulnerabilities 2
-
Medium 5.9
Dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported ds/dnskey replies
A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffe…
-
Medium 5.3
Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation
An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A…