Skip to main content

dnsmasq CVE-2026-2291

| EUVDEUVD-2026-29091 HIGH
2026-05-11 certcc GHSA-hjxh-hmm9-wcmc
Buffer Overflow Dnsmasq
7.3
CVSS 3.1 · Vendor: certcc
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify dnsmasq resolver reachable for queries or responses
  2. Delivery
    Lure victim lookup of attacker-controlled domain
  3. Exploit
    Return crafted DNS response with oversized escaped name
  4. Execution
    Trigger heap OOB write in bigname via extract_name()
  5. Persist
    Corrupt cache entry or destabilize process
  6. Impact
    Redirect future lookups to attacker IP or crash resolver

Vulnerability Assessment

Exploitation Conditions

Exploitation requires dnsmasq to process an attacker-influenced DNS message - either as a forwarder receiving a response from a queried upstream (the typical path, reachable by enticing any client behind the resolver to look up an attacker-controlled domain) or as a server receiving a query from a peer that can reach its listening port (default UDP/TCP 53). No authentication or user interaction is needed (CVSS PR:N/UI:N), and the target must be running dnsmasq from the 2.92/2.93 line per the Pi-hole upstream writeup. Limiting factors: the malicious name must be shaped so its escaped expansion overflows the bigname buffer, reliable code execution or precise cache-entry placement depends on heap layout (CISA SSVC marks the bug Automatable=no), and resolvers bound only to internal interfaces are not reachable from arbitrary remote networks even though the CVSS vector is AV:N.
Impact

Signals diverge sharply here. CVSS 7.3 (AV:N/AC:L/PR:N/UI:N, partial CIA impact) describes a network-reachable, unauthenticated, low-complexity bug - which on paper warrants prompt patching, especially given dnsmasq's role as a forwarder exposed to upstream and peer DNS traffic. However, EPSS is 0.03% (9th percentile), CISA SSVC rates Exploitation as 'none' and Automatable as 'no' with only Partial technical impact, and the vulnerability is not in CISA KEV. Practically, heap layout sensitivity and the need for a specific name shape make weaponization non-trivial, which matches the SSVC 'not automatable' verdict. The realistic priority is medium: patch on a normal cadence for internet-facing resolvers and embedded gateways, but this is not an active-incident-grade emergency. Note that the CVE description names extract_name() as the entry point, while the Pi-hole release notes pin the actual overflow to the bigname namebuffer reached via extract_name - the two are consistent but the description's emphasis on 'cache poisoning' is broader than the upstream root-cause writeup, which centers on the OOB write itself.
Exploit ScenarioDerived

An attacker controlling or able to inject responses from an upstream DNS authoritative server (for example, by luring dnsmasq to query an attacker-controlled domain) returns a crafted response containing a name whose escaped form exceeds MAXDNAME, triggering the heap out-of-bounds write inside the bigname buffer during extract_name() processing. The corruption is leveraged either to poison the local cache so subsequent lookups for legitimate names resolve to attacker-controlled IPs, or simply to crash dnsmasq for denial of service against every downstream client. No public exploit identified at time of analysis, and SSVC rates the bug as not automatable, reflecting the heap-massaging effort required.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 08, 2026

Heap buffer overflow in dnsmasq's extract_name() function allows remote attackers to write out-of-bounds on the heap, enabling DNS cache poisoning that redirects lookups to attacker-controlled IP addresses or causes denial of service. The flaw stems from a bigname namebuffer sized for wire-form domain names (MAXDNAME) instead of the larger escaped internal representation (MAXDNAME*2 + 1). EPSS is low (0.03%, 9th percentile) with no public exploit identified at time of analysis, but multiple major distributions (Red Hat, SUSE, Ubuntu) have shipped patches reflecting widespread downstream exposure.

RemediationAI

Patch available per vendor advisory - apply the upstream dnsmasq fixes published at thekelleys.org.uk/dnsmasq/CVE/ via your distribution. For Red Hat consume RHSA-2026:19158 or RHSA-2026:19373 (access.redhat.com/errata/RHSA-2026:19158, access.redhat.com/errata/RHSA-2026:19373); for SUSE apply SUSE-SU-2026:1826 or SUSE-SU-2026:1827; for Ubuntu install USN-8268-1; for Pi-hole upgrade FTL to v6.6.2 (github.com/pi-hole/FTL/releases/tag/v6.6.2); for NixOS use the 2.92rel2 rebuild from PR 519082/519093. If immediate patching is not possible, restrict the resolver's exposure by binding dnsmasq to trusted interfaces only with --interface or --listen-address (side effect: breaks resolution for clients on excluded networks), and place an upstream validating resolver or DNS firewall between dnsmasq and untrusted networks so adversarial responses are filtered before reaching extract_name() (side effect: added latency and operational dependency). Disabling DNS forwarding entirely with --port=0 mitigates the DNS path but disables the resolver function, so it is only viable on hosts using dnsmasq purely for DHCP/TFTP.

Affected VersionsENISA

dnsmasq 2.93

Affected Packages

euvd dnsmasq no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

dnsmasq is a lightweight DNS forwarder, DHCP server, and TFTP server widely deployed on routers, embedded devices, and Linux distributions as the default local resolver. The bug lives in extract_name(), which decodes DNS wire-format labels into a human-readable escaped form (where bytes like dots or non-printables expand to multi-character escape sequences). The on-heap 'struct bigname' buffer was allocated using MAXDNAME (sufficient for the compressed wire form) rather than MAXDNAME*2 + 1 needed for the worst-case escaped output, so a sufficiently adversarial name overflows the heap allocation. Although no CWE is assigned in the input, the root cause maps to CWE-122 (heap-based buffer overflow) driven by an undersized destination buffer in name canonicalization.

Know when Dnsmasq gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (certcc) PRIMARY 7.3 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
SUSE HIGH
Red Hat 6.5 MEDIUM

Primary rating from Vendor (certcc).

CVSS VectorVendor: certcc

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

2
CVSS changed
May 13, 2026 - 15:52 NVD
7.3 (HIGH)
CVE Published
May 11, 2026 - 16:47 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.

Zero Day Initiative Advisories

ZDI-26-441 dnsmasq DNS Response Heap-based Buffer Overflow Remote Code Execution Vulnerability Jul 2026

Executive ViewAI

Why It Matters

A DNS infrastructure vulnerability in dnsmasq could allow attackers to redirect traffic or disable DNS services across enterprise networks. Organizations operating dnsmasq on internal servers, routers, and network infrastructure face risk of service disruption and potential traffic interception. Multiple Linux vendors have released patches, enabling rapid remediation to restore security posture.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 91% exploitable
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Dnsmasq

View all
CVE-2017-14492 CRITICAL POC
9.8 Oct 03

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
CVE-2017-14491 CRITICAL POC
9.8 Oct 04

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
CVE-2017-13704 HIGH
7.5 Oct 03

In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call get
CVE-2017-14495 HIGH POC
7.5 Oct 03

Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote

CVE-2017-14496 HIGH POC
7.5 Oct 03

Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-su
CVE-2017-14493 CRITICAL POC
9.8 Oct 03

Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execu
CVE-2017-14494 MEDIUM POC
5.9 Oct 03

dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vect
CVE-2019-14513 HIGH POC
7.5 Aug 01

Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that

CVE-2015-3294 MEDIUM POC
6.4 May 08

The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function
CVE-2013-0198 MEDIUM POC
5.0 Mar 05

Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces,

CVE-2026-4892 HIGH
8.4 May 11

Heap-based buffer overflow in dnsmasq's DHCPv6 implementation enables local attackers to execute arbitrary code with roo
CVE-2021-3448 MEDIUM POC
4.0 Apr 08

A flaw was found in dnsmasq in versions before 2.85. Rated medium severity (CVSS 4.0), this vulnerability is remotely ex

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:19158 ADVISORY https://access.redhat.com/errata/RHSA-2026:19373 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-2291 ADVISORY https://ubuntu.com/security/notices/USN-8268-1 ADVISORY https://vuldb.com/vuln/362703 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1826/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1827/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1828/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1934/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21626/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21633/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21640/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21677/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21733/ REF http://www.openwall.com/lists/oss-security/2026/07/20/14 REF https://github.com/NixOS/nixpkgs/pull/519082 REF https://github.com/NixOS/nixpkgs/pull/519093 REF https://github.com/pi-hole/FTL/releases/tag/v6.6.2 REF https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html REF https://thekelleys.org.uk/dnsmasq/CVE/ REF https://thekelleys.org.uk/dnsmasq/doc.html REF https://www.kb.cert.org/vuls/id/471747 REF https://www.suse.com/security/cve/CVE-2026-2291.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy