Skip to main content

dnsmasq EUVDEUVD-2026-29153

| CVE-2026-4891 MEDIUM
Out-of-bounds Read (CWE-125)
2026-05-11 certcc GHSA-2qp9-xr4x-2cr9
Denial Of Service Buffer Overflow Information Disclosure Dnsmasq
5.3
CVSS 3.1 · Vendor: certcc
Share

Severity by source

Vendor (certcc) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
SUSE
MEDIUM
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (certcc).

CVSS VectorVendor: certcc

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

5
Source Code Evidence Fetched
May 11, 2026 - 19:46 vuln.today
Analysis Generated
May 11, 2026 - 19:46 vuln.today
CVSS changed
May 11, 2026 - 19:22 NVD
5.3 (MEDIUM)
CVE Published
May 11, 2026 - 16:47 nvd
UNKNOWN (no severity yet)
CVE Published
May 11, 2026 - 16:47 nvd
MEDIUM 5.3

DescriptionCVE.org

A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.

AnalysisAI

Heap-based out-of-bounds read in dnsmasq DNSSEC validation allows remote unauthenticated attackers to trigger a denial of service by sending a crafted DNS packet. The vulnerability affects dnsmasq 2.93 and potentially earlier versions; CVSS 5.3 with network-based access vector indicates moderate severity. No public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

The vulnerability resides in dnsmasq's DNSSEC packet validation logic during DNS message parsing. When processing DNS responses containing DNSSEC records, the parser fails to properly validate buffer boundaries during an out-of-bounds read operation, likely within the signature or record data handling routines. The heap memory access violation occurs on the network layer (AV:N) without requiring authentication (PR:N) or user interaction (UI:N), meaning any remote host can send a malicious DNS packet to trigger the flaw. The root cause class (CWE not provided) appears to be improper input validation combined with insufficient bounds checking in DNSSEC record deserialization.

RemediationAI

Upgrade dnsmasq to version 2.92rel2 or later (patched version confirmed via NixOS package update). The upstream fix is documented in dnsmasq mailing list thread at https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html. For environments unable to upgrade immediately: (1) disable DNSSEC validation if not critical to operations (trade-off: loses DNSSEC protection), (2) restrict DNS query sources to trusted networks using dnsmasq firewall rules or network ACLs to reduce exposure to remote unauthenticated attackers, or (3) run dnsmasq in a container or sandbox to limit impact of a potential crash. If DNSSEC is required, prioritize patching over workarounds. Monitor dnsmasq logs for crashes or suspicious DNS queries from external sources.

More in Dnsmasq

View all
CVE-2017-14492 CRITICAL POC
9.8 Oct 03

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
CVE-2017-14491 CRITICAL POC
9.8 Oct 04

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
CVE-2017-13704 HIGH
7.5 Oct 03

In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call get
CVE-2017-14495 HIGH POC
7.5 Oct 03

Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote

CVE-2017-14496 HIGH POC
7.5 Oct 03

Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-su
CVE-2017-14493 CRITICAL POC
9.8 Oct 03

Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execu
CVE-2017-14494 MEDIUM POC
5.9 Oct 03

dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vect
CVE-2019-14513 HIGH POC
7.5 Aug 01

Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that

CVE-2015-3294 MEDIUM POC
6.4 May 08

The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function
CVE-2013-0198 MEDIUM POC
5.0 Mar 05

Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces,

CVE-2026-4892 HIGH
8.4 May 11

Heap-based buffer overflow in dnsmasq's DHCPv6 implementation enables local attackers to execute arbitrary code with roo
CVE-2021-3448 MEDIUM POC
4.0 Apr 08

A flaw was found in dnsmasq in versions before 2.85. Rated medium severity (CVSS 4.0), this vulnerability is remotely ex

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2016-1646 HIGH POC
8.8
CVE-2025-5777 HIGH POC
7.5
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed
SUSE Linux Enterprise Micro 5.5 Fixed

Share

EUVD-2026-29153 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy