dnsmasq EUVD-2026-112790

Exploitation requires network reachability to the dnsmasq TCP DNS listener on port 53 - i.e., TCP DNS service must be enabled and exposed to the attacker. The specific trigger is opening idle TCP connections that send no receive-triggering data, exploiting the absence of a receive timeout combined with a small fixed pool of child processes. No authentication, user interaction, or special client-side configuration is needed (PR:N/UI:N). Limiting factors: impact is confined to availability of TCP DNS and TCP-fallback DNSSEC validation (UDP resolution keeps working), and occupied slots auto-release after a fixed lifetime, so the denial of service is partial and time-bounded rather than permanent; exposure also depends on whether port 53/TCP is reachable from untrusted networks rather than firewalled to trusted clients.

This is a genuine but bounded denial-of-service issue, correctly rated medium rather than a top priority. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, 5.3) aligns well with the description: remote, unauthenticated, low-complexity, with impact limited to availability only (C:N/I:N). The A:L (low, not high) is appropriate because the description explicitly states UDP DNS resolution continues and occupied slots are released after a fixed lifetime, so the outage is partial and self-healing rather than a total service kill. No EPSS score was provided, and there is no CISA KEV listing and no public exploit reference in the input, so there is no public exploit identified at time of analysis. Red Hat's own priority signal is 'this_month' (not act_now/emergency), consistent with a moderate, non-urgent DoS. The one practical concern a defender should weigh is the secondary effect called out in the description: because DNSSEC validation that requires TCP fallback is blocked when the pool is exhausted, resolution of responses too large for UDP (or truncated responses) can fail, which in some configurations degrades more than just TCP queries. No key signals conflict here; the main gap is the absence of EPSS and any independent exploitation data.

A remote, unauthenticated attacker opens a handful of TCP connections to port 53 on a dnsmasq resolver and simply leaves them idle, sending no (or incomplete) data. Because the TCP DNS service uses a small fixed pool of child processes and sets no receive timeout, those idle connections occupy the entire pool and block new TCP DNS connections and TCP-fallback DNSSEC validation until each slot expires at its fixed lifetime. No exploit code is referenced in the available data; the technique requires only the ability to establish TCP connections to the listener.