CVE-2026-93011
Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms
MEDIUM 5.3
At a glance
- Source
- CVE.org
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
Description
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.
Weaknesses (CWE)
- CWE-787 — Out-of-bounds Write
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | redhat |
European references
- ENISA EUVD · EUVD-2026-112789
- GCVE · GCVE-0-2026-93011
Affected products
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |