Skip to main content

dnsmasq CVE-2026-4890

| EUVDEUVD-2026-29152 HIGH
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-05-11 certcc GHSA-32px-jfgq-53xf
Denial Of Service Dnsmasq
7.5
CVSS 3.1 · Vendor: certcc
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious DNSSEC packet
  2. Delivery
    Send DNS query to target resolver
  3. Exploit
    Trigger validation logic flaw
  4. Execution
    Exhaust resources or crash process
  5. Impact
    DNS service unavailable

Vulnerability Assessment

Weakness
CWE
CWE-835
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

DNSSEC validation must be explicitly enabled in dnsmasq configuration (via 'dnssec' directive and trust anchors in dnsmasq.conf). The server must be network-reachable on UDP/TCP port 53 to receive DNS queries (AV:N). No authentication required (PR:N) - any remote attacker can send crafted DNS packets. No user interaction needed (UI:N) - automated exploitation against default DNSSEC-enabled configurations of dnsmasq 2.93. Exploitation is LIMITED by DNSSEC adoption: many dnsmasq deployments in embedded devices and home routers do not enable DNSSEC validation by default, significantly reducing real-world attack surface compared to theoretical scope. Internet-exposed recursive resolvers with DNSSEC enabled face highest risk.
Impact

Real-world risk is MODERATE to HIGH for internet-facing dnsmasq deployments with DNSSEC enabled. CVSS 7.5 reflects network vector, no authentication, and high availability impact (complete service disruption). Attack complexity is LOW, meaning exploitation requires only standard DNS protocol knowledge. However, several factors lower practical risk: (1) DNSSEC validation must be explicitly enabled (not default in many dnsmasq deployments), (2) no public exploit identified at time of analysis (limits script-kiddie attacks), (3) CERT/CC involvement (VU#471747) suggests coordinated disclosure with patches available before widespread exploitation. The vulnerability is LIMITED to availability impact only - no data theft or code execution - reducing business criticality for non-critical DNS servers. Upstream fix exists (2.92rel2) per GitHub evidence, though EUVD lists 2.93 as affected while patches reference 2.92 branch, creating version confusion requiring vendor clarification. Organizations using dnsmasq without DNSSEC or in internal-only roles face minimal risk. Internet-exposed recursive resolvers with DNSSEC validation enabled should prioritize patching.
Exploit ScenarioDerived

An external attacker sends a specially crafted DNS query with malicious DNSSEC records (signatures, delegation chains, or key material) to a public-facing dnsmasq resolver with DNSSEC validation enabled. The malformed packet triggers excessive resource consumption or a crash in the DNSSEC validation code path, causing the DNS server to become unresponsive. Legitimate users lose DNS resolution services, disrupting internet access for downstream clients (home users, enterprise networks, IoT devices). The attacker can sustain the attack with minimal resources due to low complexity (AC:L), requiring only standard DNS protocol tools. No public exploit identified at time of analysis, but the attack technique is straightforward given DNSSEC protocol knowledge.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 11, 2026

Remote unauthenticated attackers can crash dnsmasq DNS servers via crafted packets exploiting DNSSEC validation logic. The vulnerability affects dnsmasq 2.93 with CVSS 7.5 (high severity). Upstream fix is available in version 2.92rel2 per NixOS packaging commits, though official vendor release status requires confirmation. No public exploit identified at time of analysis, with CERT/CC tracking (VU#471747) suggesting coordinated disclosure.

RemediationAI

Upgrade to dnsmasq version 2.92rel2 or later, as evidenced by upstream fixes in NixOS packaging commits (https://github.com/NixOS/nixpkgs/pull/519082 and https://github.com/NixOS/nixpkgs/pull/519093). Consult the official vendor CVE page (https://thekelleys.org.uk/dnsmasq/CVE/) and mailing list announcement (https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html) for authoritative patch guidance, as version numbering discrepancy (2.93 listed as vulnerable while patches target 2.92rel2) requires vendor clarification. If immediate patching is not feasible, disable DNSSEC validation by removing 'dnssec' and 'trust-anchor' directives from dnsmasq.conf as a temporary workaround - this eliminates attack surface but removes DNSSEC protection against cache poisoning, creating a different security trade-off unsuitable for security-sensitive environments. For internet-facing resolvers, consider switching to alternative DNSSEC-capable resolvers (BIND, Unbound) until patching is complete. Network-level mitigation via rate-limiting DNS queries from untrusted sources may reduce DoS impact but does not prevent exploitation.

Affected VersionsENISA

dnsmasq 2.93

Affected Packages

euvd dnsmasq no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

dnsmasq is a lightweight DNS forwarder and DHCP server widely deployed in embedded devices, routers, and Linux distributions. This vulnerability targets the DNSSEC (DNS Security Extensions) validation component, which cryptographically verifies DNS responses to prevent cache poisoning. The affected CPE (cpe:2.3:a:dnsmasq:dnsmasq) encompasses all dnsmasq deployments with DNSSEC validation enabled. EUVD data specifically identifies version 2.93 as affected. Without a CWE classification, the root cause class is unclear, but DoS in DNSSEC validators often stems from resource exhaustion parsing malformed DNSSEC records (signatures, keys, delegation chains) or algorithmic complexity attacks. The CVSS vector (AV:N/AC:L) indicates network-reachable exploitation with low complexity, meaning standard DNS query mechanisms suffice.

Know when Dnsmasq gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (certcc) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (certcc).

CVSS VectorVendor: certcc

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
May 11, 2026 - 19:22 NVD
7.5 (HIGH)
CVE Published
May 11, 2026 - 16:47 nvd
UNKNOWN (no severity yet)
CVE Published
May 11, 2026 - 16:47 nvd
HIGH 7.5

DescriptionCVE.org

A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.

Zero Day Initiative Advisories

ZDI-26-584 dnsmasq DNSSEC NSEC/NSEC3 Type Bitmap Processing Infinite Loop Denial-of-Service Vulnerability Aug 2026

Executive ViewAI

Why It Matters

CVE-2026-4890 is a high-severity denial-of-service vulnerability affecting dnsmasq DNS servers that allows unauthenticated remote attackers to crash services through malicious DNSSEC packets. Organizations relying on dnsmasq for DNS infrastructure face potential service outages and business continuity disruption. Immediate inventory and patching of affected dnsmasq 2.93 instances is required to prevent exploitation.

Business Impact: High
Compensating Controls

Vendor-released patch: dnsmasq 2.92rel2 or later. If patching cannot be immediately deployed, implement network-based filtering to restrict DNSSEC-related traffic from untrusted sources and monitor dnsmasq process availability with automatic restart capabilities to minimize outage duration.

Threat Intelligence Overview

EPSS Score
0.2%
Top 61% exploitable
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Dnsmasq

View all
CVE-2017-14492 CRITICAL POC
9.8 Oct 03

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
CVE-2017-14491 CRITICAL POC
9.8 Oct 04

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
CVE-2017-13704 HIGH
7.5 Oct 03

In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call get
CVE-2017-14495 HIGH POC
7.5 Oct 03

Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote

CVE-2017-14496 HIGH POC
7.5 Oct 03

Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-su
CVE-2017-14493 CRITICAL POC
9.8 Oct 03

Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execu
CVE-2017-14494 MEDIUM POC
5.9 Oct 03

dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vect
CVE-2019-14513 HIGH POC
7.5 Aug 01

Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that

CVE-2015-3294 MEDIUM POC
6.4 May 08

The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function
CVE-2013-0198 MEDIUM POC
5.0 Mar 05

Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces,

CVE-2026-4892 HIGH
8.4 May 11

Heap-based buffer overflow in dnsmasq's DHCPv6 implementation enables local attackers to execute arbitrary code with roo
CVE-2021-3448 MEDIUM POC
4.0 Apr 08

A flaw was found in dnsmasq in versions before 2.85. Rated medium severity (CVSS 4.0), this vulnerability is remotely ex

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed
SUSE Linux Enterprise Micro 5.5 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-4890 ADVISORY https://ubuntu.com/security/notices/USN-8268-1 ADVISORY https://vuldb.com/vuln/362746 REF https://access.redhat.com/errata/RHSA-2026:19158 REF https://access.redhat.com/errata/RHSA-2026:19373 REF https://access.redhat.com/errata/RHSA-2026:20589 REF https://access.redhat.com/errata/RHSA-2026:34508 REF https://access.redhat.com/errata/RHSA-2026:40762 REF https://access.redhat.com/security/cve/CVE-2026-4890 REF https://bugzilla.redhat.com/show_bug.cgi?id=2458516 REF https://github.com/NixOS/nixpkgs/pull/519082 REF https://github.com/NixOS/nixpkgs/pull/519093 REF https://github.com/pi-hole/FTL/releases/tag/v6.6.2 REF https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4890.json REF https://thekelleys.org.uk/dnsmasq/ REF https://thekelleys.org.uk/dnsmasq/CVE/ REF https://www.kb.cert.org/vuls/id/471747

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy