Skip to main content

dnsmasq EUVDEUVD-2026-29155

| CVE-2026-4893 MEDIUM
2026-05-11 certcc GHSA-4rrv-pmrh-2vc4
Information Disclosure Red Hat Suse Dnsmasq
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

5
Source Code Evidence Fetched
May 11, 2026 - 19:47 vuln.today
Analysis Generated
May 11, 2026 - 19:47 vuln.today
CVSS changed
May 11, 2026 - 19:22 NVD
5.3 (MEDIUM)
CVE Published
May 11, 2026 - 16:48 nvd
UNKNOWN (no severity yet)
CVE Published
May 11, 2026 - 16:48 nvd
MEDIUM 5.3

DescriptionCVE.org

An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information.

AnalysisAI

Information disclosure in dnsmasq 2.93 allows remote attackers to bypass source IP validation checks by sending crafted DNS packets containing RFC 7871 client subnet (EDNS Client Subnet) information. The vulnerability enables attackers to determine internal network information that should remain hidden behind source address filtering, affecting the confidentiality of network topology and potentially enabling further reconnaissance. CVSS 5.3 reflects the network-accessible nature with low complexity but limited direct impact.

Technical ContextAI

dnsmasq is a lightweight DNS forwarder and DHCP server commonly deployed in routers, NAS devices, and network appliances. The vulnerability stems from improper validation of RFC 7871 EDNS Client Subnet (ECS) extension in DNS queries. ECS allows DNS queries to include the requesting client's subnet information, intended for geolocation-aware responses. dnsmasq's source IP checking mechanism, which validates that DNS responses originate from legitimate sources, fails to properly account for ECS-based spoofing. When RFC 7871 ECS information is included in a crafted packet, the vulnerable code bypasses normal source address validation, allowing an attacker to determine or infer internal network information that the DNS server intended to restrict. CWE information not provided in source data, but this falls under the domain of improper input validation and authentication bypass in network protocol handling.

RemediationAI

Upgrade to dnsmasq version 2.92rel2 or later, which incorporates the RFC 7871 source validation fix confirmed in NixOS PR #519082 and #519093. The upstream fix is documented in the dnsmasq mailing list at https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html and the official CVE page at https://thekelleys.org.uk/dnsmasq/CVE/. If immediate patching is not possible, implement network-level mitigations: restrict DNS query access to trusted subnets via firewall rules on port 53 (UDP/TCP), disable EDNS extensions if operationally feasible (though this may break legitimate functionality for clients using ECS), or deploy dnsmasq behind a filtering DNS proxy that strips or validates ECS headers. These mitigations reduce the attack surface but do not remediate the underlying vulnerability and may impact DNS resolution performance for geolocation-dependent services.

More in Dnsmasq

View all
CVE-2017-14492 CRITICAL POC
9.8 Oct 03

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
CVE-2017-14491 CRITICAL POC
9.8 Oct 04

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
CVE-2017-13704 HIGH
7.5 Oct 03

In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call get
CVE-2017-14495 HIGH POC
7.5 Oct 03

Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote

CVE-2017-14496 HIGH POC
7.5 Oct 03

Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-su
CVE-2017-14493 CRITICAL POC
9.8 Oct 03

Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execu
CVE-2017-14494 MEDIUM POC
5.9 Oct 03

dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vect
CVE-2019-14513 HIGH POC
7.5 Aug 01

Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that

CVE-2015-3294 MEDIUM POC
6.4 May 08

The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function
CVE-2013-0198 MEDIUM POC
5.0 Mar 05

Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces,

CVE-2026-4892 HIGH
8.4 May 11

Heap-based buffer overflow in dnsmasq's DHCPv6 implementation enables local attackers to execute arbitrary code with roo
CVE-2021-3448 MEDIUM POC
4.0 Apr 08

A flaw was found in dnsmasq in versions before 2.85. Rated medium severity (CVSS 4.0), this vulnerability is remotely ex

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed
SUSE Linux Enterprise Micro 5.5 Fixed

Share

EUVD-2026-29155 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy