Skip to main content

dnsmasq CVE-2026-5172

| EUVDEUVD-2026-29156 HIGH
Out-of-bounds Read (CWE-125)
2026-05-11 certcc GHSA-57vp-ffx7-7gm6
Buffer Overflow Information Disclosure Dnsmasq
7.3
CVSS 3.1 · Vendor: certcc
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker controls or MITMs upstream DNS path
  2. Delivery
    Victim dnsmasq forwards a recursive query
  3. Exploit
    Attacker returns DNS response with mismatched RR rdlen
  4. Execution
    extract_addresses() calls extract_name() past record end
  5. Persist
    Heap out-of-bounds read in dnsmasq process
  6. Impact
    Daemon crashes and DNS service for downstream clients fails

Vulnerability Assessment

Weakness
CWE
CWE-125
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the attacker to deliver a crafted DNS response that dnsmasq will parse - specifically a malformed resource record whose rdlen field is smaller than the actual record body, causing extract_name() to walk past the record's end. This requires the attacker either to operate an authoritative DNS server that dnsmasq recursively queries (trivial: register a domain and have a victim client resolve a name under it), to be on-path between dnsmasq and its upstream resolver, or to be the configured upstream resolver itself. No authentication is required (CVSS PR:N) and no user interaction beyond a normal DNS query is needed (UI:N). Limiting factors: dnsmasq must be configured as a forwarder/resolver (its default role) and must actually parse the malicious response, so deployments that hard-restrict upstream servers to trusted recursive resolvers materially reduce risk; impact is bounded to a crash plus limited heap memory disclosure rather than code execution, per CVSS C:L/I:L/A:L and SSVC 'partial' technical impact.
Impact

Signals are largely consistent and point to a real but moderate-priority issue rather than an emergency. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with low C/I/A impacts (7.3 total) reflects a remote, unauthenticated, low-complexity trigger producing a crash plus limited memory disclosure - not RCE. CISA SSVC corroborates this: exploitation 'none', automatable 'no', technical impact 'partial'. EPSS is very low at 0.03% (9th percentile), and the CVE is not on CISA KEV. There is no public exploit identified at time of analysis. The practical attack surface is constrained: an attacker must be in a position to deliver a crafted DNS response (an upstream resolver dnsmasq queries, a man-in-the-middle, or a malicious authoritative server reached via recursive forwarding), which is realistic for forwarding deployments but not trivial. Net: patch on a normal cadence; prioritize for internet-exposed or untrusted-upstream dnsmasq instances.
Exploit ScenarioDerived

An attacker positioned to answer DNS queries that a dnsmasq instance forwards - for example, by running a malicious authoritative server for a domain the victim's clients query, or by MITM on the path between dnsmasq and its upstream resolver - returns a DNS response containing a resource record whose declared rdlen is shorter than the actual name encoded inside it. When dnsmasq's extract_addresses() invokes extract_name() on the record, the pointer advances past the record boundary and reads adjacent heap memory, crashing the process and disrupting DNS for every downstream client. No public exploit is identified at time of analysis, though the bug is reachable pre-authentication and the trigger is straightforward to construct from the published description.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 08, 2026

Remote denial-of-service and limited information disclosure in dnsmasq's extract_addresses() function allows attackers controlling or able to inject DNS responses to crash the daemon by sending a malformed DNS record whose declared rdlen pushes extract_name() past the record boundary, triggering a heap out-of-bounds read. The flaw affects dnsmasq 2.93 and downstream packages from Red Hat, SUSE, Ubuntu, and Pi-hole FTL. No public exploit identified at time of analysis, EPSS exploitation probability is 0.03% (9th percentile), and CISA SSVC rates exploitation as 'none' with only partial technical impact.

RemediationAI

Apply vendor-released patches as soon as available: upgrade Pi-hole FTL to v6.6.2 or later (https://github.com/pi-hole/FTL/releases/tag/v6.6.2), apply Red Hat RHSA-2026:19158 (https://access.redhat.com/errata/RHSA-2026:19158), Ubuntu USN-8268-1 (https://ubuntu.com/security/notices/USN-8268-1), and the relevant SUSE-SU-2026 advisories (1934, 21640, 21677, 21733) for SUSE products. For source builds, apply the upstream patches published at https://thekelleys.org.uk/dnsmasq/CVE/ or move to the 2.92rel2-equivalent rebuild that downstream maintainers (e.g., NixOS PRs 519082/519093) have adopted; consult the upstream announcement at https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html and the CERT/CC note at https://www.kb.cert.org/vuls/id/471747. Where patching must be deferred, the most useful compensating controls are: restrict dnsmasq's upstream resolvers (--server / resolv.conf) to trusted servers reachable only over a trusted path, since this bug requires a crafted response to be parsed; place dnsmasq behind a validating resolver that drops malformed responses; firewall UDP/TCP 53 inbound to internal-only sources so that external attackers cannot directly answer recursive queries (trade-off: breaks DNS for any external clients that legitimately use the resolver); and monitor for repeated dnsmasq crash-restart cycles in supervisord/systemd logs as a detection signal. Disabling DNS forwarding entirely is a stronger but service-affecting fallback.

Affected VersionsENISA

dnsmasq 2.93

Affected Packages

euvd dnsmasq no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

dnsmasq is a lightweight DNS forwarder and DHCP server widely deployed on Linux distributions, home routers, container networks, and ad-blocking appliances such as Pi-hole. The vulnerability resides in extract_addresses(), the routine that walks resource records (RRs) in a DNS response. When parsing an RR, dnsmasq uses each record's declared rdlen to bound the remaining buffer; a mismatched rdlen value causes the helper extract_name() to advance its pointer past the computed end of the record, underflowing the remaining-bytes calculation and producing an out-of-bounds read on heap memory. This is a classic buffer over-read (CWE-125-class issue, though no CWE was assigned in NVD data) arising from trusting attacker-controlled length fields in untrusted network input. The Pi-hole FTL release notes confirm the root cause: 'a mismatched RR rdlen allowed extract_name() to advance past the computed end of the record.'

Know when Dnsmasq gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (certcc) PRIMARY 7.3 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (certcc).

CVSS VectorVendor: certcc

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

2
CVSS changed
May 13, 2026 - 15:52 NVD
7.3 (HIGH)
CVE Published
May 11, 2026 - 16:48 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the pointer past the record’s end.

Executive ViewAI

Why It Matters

dnsmasq versions 2.93 and downstream packages (Red Hat, SUSE, Ubuntu, Pi-hole FTL) contain a remotely-triggered denial-of-service vulnerability that could disrupt DNS resolution services across your infrastructure. While no public exploit has been identified, the critical role of DNS in network operations warrants prompt patching within normal security cycles.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 91% exploitable
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Dnsmasq

View all
CVE-2017-14492 CRITICAL POC
9.8 Oct 03

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
CVE-2017-14491 CRITICAL POC
9.8 Oct 04

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
CVE-2017-13704 HIGH
7.5 Oct 03

In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call get
CVE-2017-14495 HIGH POC
7.5 Oct 03

Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote

CVE-2017-14496 HIGH POC
7.5 Oct 03

Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-su
CVE-2017-14493 CRITICAL POC
9.8 Oct 03

Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execu
CVE-2017-14494 MEDIUM POC
5.9 Oct 03

dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vect
CVE-2019-14513 HIGH POC
7.5 Aug 01

Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that

CVE-2015-3294 MEDIUM POC
6.4 May 08

The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function
CVE-2013-0198 MEDIUM POC
5.0 Mar 05

Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces,

CVE-2026-4892 HIGH
8.4 May 11

Heap-based buffer overflow in dnsmasq's DHCPv6 implementation enables local attackers to execute arbitrary code with roo
CVE-2021-3448 MEDIUM POC
4.0 Apr 08

A flaw was found in dnsmasq in versions before 2.85. Rated medium severity (CVSS 4.0), this vulnerability is remotely ex

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:19158 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-5172 ADVISORY https://ubuntu.com/security/notices/USN-8268-1 ADVISORY https://vuldb.com/vuln/362739 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1934/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21640/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21677/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21733/ REF https://access.redhat.com/security/cve/CVE-2026-5172 REF https://bugzilla.redhat.com/show_bug.cgi?id=2458521 REF https://github.com/NixOS/nixpkgs/pull/519082 REF https://github.com/NixOS/nixpkgs/pull/519093 REF https://github.com/pi-hole/FTL/releases/tag/v6.6.2 REF https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5172.json REF https://thekelleys.org.uk/dnsmasq/ REF https://thekelleys.org.uk/dnsmasq/CVE/ REF https://www.kb.cert.org/vuls/id/471747

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy