dnsmasq EUVD-2026-38278

Exploitation requires the target dnsmasq instance to have BOTH the dnssec option (DNSSEC validation) AND the log-queries option (query logging) explicitly enabled in dnsmasq.conf - neither is active in default dnsmasq configurations, which significantly limits the exposed population. The attacker must additionally be capable of supplying a DNS response that reaches the dnsmasq resolver containing a DS or DNSKEY record with an unsupported algorithm or digest type; this can be achieved by controlling an authoritative name server for a queried zone, performing DNS cache poisoning, or intercepting DNS traffic on the network path. Authentication is not required (PR:N per CVSS vector). Exploitation is bounded to availability impact only - process crash and denial of service - with no path to code execution, data exfiltration, or integrity compromise. Systems running dnsmasq without the simultaneous DNSSEC-plus-logging configuration are not exposed to this vulnerability.

The CVSS 3.1 base score of 5.9 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H is well-calibrated to the described vulnerability. AV:N confirms the attack is network-deliverable via a crafted DNS response; however, AC:H correctly reflects that exploitation is gated on a non-default dual-configuration requirement - both DNSSEC validation and query logging must be explicitly enabled. Impact is strictly limited to availability (A:H, process crash); no confidentiality or integrity impact is present, making this a pure DoS. No EPSS score was provided in the available intelligence, and the CVE is absent from the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. No public proof-of-concept code has been identified. The practical risk is moderate: organizations running dnsmasq as a DNSSEC-validating resolver with logging enabled - common in enterprise DNS infrastructure and OpenShift node networking - face genuine service disruption exposure, but the non-default configuration gate sharply limits the exposed population compared to a default-configuration exploit.

An attacker operating a malicious authoritative DNS server for a delegated zone - or capable of injecting DNS responses via cache poisoning or network interception - crafts a DNSKEY or DS record containing an algorithm or digest identifier not supported by the target dnsmasq build. When a vulnerable dnsmasq instance with both DNSSEC validation and query logging enabled resolves a name in that zone, it receives the crafted response, attempts to log the unsupported record, overflows the internal heap logging buffer, and crashes - taking down DNS and DHCP services for all clients dependent on that dnsmasq instance. No public proof-of-concept code has been identified at time of analysis.