Description
A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | dnsmasq | Fedora version prior to 31, all RHEL versions | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dnsmasq | 2.69-1 | — |
| Debian 13 | dnsmasq | 2.69-1 | — |
| Debian 12 | dnsmasq | 2.69-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | dnsmasq | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | dnsmasq | 2.86-7.14.1 | SUSE-SU-2021:3530-1 |
| SLES 15 SP2 | dnsmasq | 2.86-7.14.1 | SUSE-SU-2021:3530-1 |
| SLES 15 SP1 | dnsmasq | 2.86-7.14.1 | SUSE-SU-2021:3530-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP1 | dnsmasq | 2.86-7.14.1 | SUSE-SU-2021:3530-1 |
| SLE Micro 5.1 | dnsmasq | 2.86-7.14.1 | SUSE-SU-2021:3530-1 |
| SLE Micro 5.0 | dnsmasq | 2.86-7.14.1 | SUSE-SU-2021:3530-1 |
| SLE HPC 15 SP1 | dnsmasq | 2.86-7.14.1 | SUSE-SU-2021:3530-1 |
| SUSE Enterprise Storage 6 | dnsmasq | 2.86-7.14.1 | SUSE-SU-2021:3530-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dnsmasq | 2.86-3.1 | openSUSE-SU-2024:11653-1 |
| openSUSE Leap 15.3 | dnsmasq | 2.86-7.14.1 | openSUSE-SU-2021:3530-1 |
| openSUSE Leap 15.2 | dnsmasq | 2.86-lp152.7.6.1 | openSUSE-SU-2021:1426-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | dnsmasq +1 | 2.76-10.amzn2.1.1 | ALAS2-2020-1469 |
Advisories 5
- openSUSE-SU-2021:1426-1 Security update for dnsmasq SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:3530-1 Security update for dnsmasq SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:3530-1 Security update for dnsmasq SUSE / openSUSE Security Updates · May 7, 2025
- openSUSE-SU-2024:11653-1 dnsmasq-2.86-3.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- ALAS2-2020-1469 Moderate: dnsmasq security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 5, 2020