CVE-2023-49441

dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.

7.5 HighFix available

dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.66%Up 0.6 points since Feb 14, 2025

What each source reports

NVD Score used 7.5

dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.

Record: CVE-2023-49441
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-190
Updated: 2026-11-02

CVE List 7.5

dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.

Record: CVE-2023-49441
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-190
Updated: 2026-11-02

EUVDEUVD-2023-53405 7.5

dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.

Record: EUVD-2023-53405
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-wh73-785p-7wcf 7.5

dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.

dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.

Record: GHSA-wh73-785p-7wcf
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-190
Updated: 2026-11-02

OSV 7.5

dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.

Record: CVE-2023-49441
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-49441 7.5

dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.

Record: DEBIAN-CVE-2023-49441
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 6 moreShow less

OSVOESA-2024-1903 6.5

dnsmasq security update

Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.

Security Fix(es):

dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.(CVE-2023-49441)

Record: OESA-2024-1903
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2024-1904 6.5

dnsmasq security update

Security Fix(es):

dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.(CVE-2023-49441)

Record: OESA-2024-1904
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2024-1905 6.5

dnsmasq security update

Security Fix(es):

dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.(CVE-2023-49441)

Record: OESA-2024-1905
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-49441 7.5

dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.

Record: UBUNTU-CVE-2023-49441
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2024:14031-1 No score

dnsmasq-2.90-2.1 on GA media

These are all security issues fixed in the dnsmasq-2.90-2.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:14031-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21626-1 No score

Security update for dnsmasq

This update for dnsmasq fixes the following issues:

Security issues:

CVE-2023-49441: integer overflow via forward_query (bsc#1226091).
CVE-2026-2291: VU#471747: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect (bsc#1258251).

Non security issue:

Reintroduce nogroup (bsc#1235517).

Record: SUSE-SU-2026:21626-1
Updated: 2026-11-02

Affected products

thekelleys dnsmasq

Affected packages

Affected packages
Package	Affected	Fixed
`dnsmasq` Debian:12	before 2.90-1, plus listed versions 2.89-1	2.90-1
`dnsmasq` Debian:13	before 2.90-1	2.90-1
`dnsmasq` Debian:14	before 2.90-1	2.90-1
`dnsmasq` openEuler:22.03-LTS-SP3	before 2.86-8.oe2203sp3	2.86-8.oe2203sp3
`dnsmasq` openEuler:20.03-LTS-SP4	before 2.82-15.oe2003sp4	2.82-15.oe2003sp4
`dnsmasq` openEuler:22.03-LTS-SP1	before 2.86-8.oe2203sp1	2.86-8.oe2203sp1
`dnsmasq` Ubuntu:Pro:16.04:LTS	before 2.90-0ubuntu0.16.04.1+esm1, plus listed versions 2.75-12.75-1ubuntu0.16.04.12.75-1ubuntu0.16.04.22.75-1ubuntu0.16.04.32.75-1ubuntu0.16.04.4 Show 7 moreShow less 2.75-1ubuntu0.16.04.52.75-1ubuntu0.16.04.72.75-1ubuntu0.16.04.82.75-1ubuntu0.16.04.102.75-1ubuntu0.16.04.10+esm12.79-1ubuntu0.16.04.1+esm12.79-1ubuntu0.16.04.1+esm2	2.90-0ubuntu0.16.04.1+esm1
`dnsmasq` Ubuntu:Pro:18.04:LTS	before 2.90-0ubuntu0.18.04.1+esm1, plus listed versions 2.78-12.78-32.79-12.79-1ubuntu0.22.79-1ubuntu0.3 Show 4 moreShow less 2.79-1ubuntu0.42.79-1ubuntu0.52.79-1ubuntu0.62.79-1ubuntu0.7	2.90-0ubuntu0.18.04.1+esm1
`dnsmasq` Ubuntu:20.04:LTS	before 2.90-0ubuntu0.20.04.1, plus listed versions 2.80-1ubuntu22.80-1ubuntu42.80-1.1ubuntu12.80-1.1ubuntu1.22.80-1.1ubuntu1.3 Show 4 moreShow less 2.80-1.1ubuntu1.42.80-1.1ubuntu1.52.80-1.1ubuntu1.62.80-1.1ubuntu1.7	2.90-0ubuntu0.20.04.1
`dnsmasq` Ubuntu:22.04:LTS	before 2.90-0ubuntu0.22.04.1, plus listed versions 2.85-1ubuntu22.86-1.12.86-1.1ubuntu0.12.86-1.1ubuntu0.22.86-1.1ubuntu0.32.86-1.1ubuntu0.42.86-1.1ubuntu0.5	2.90-0ubuntu0.22.04.1
`dnsmasq` openSUSE:Tumbleweed	before 2.90-2.1	2.90-2.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-49441 is a high vulnerability (CVSS 7.5) in Thekelleys Dnsmasq, published June 6, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. Fixed in dnsmasq 2.90-1.

References

Show 12 moreShow less