CVE-2026-12969

Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.

Security Fix(es):

A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.(CVE-2026-12725)

An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.(CVE-2026-12969)

Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.

Security Fix(es):

A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.(CVE-2026-12725)

An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.(CVE-2026-12969)

Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.

Security Fix(es):

A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.(CVE-2026-12725)

An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.(CVE-2026-12969)

An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.

An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.

The updated dnsmasq packages fix multiple security issues: A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service. (CVE-2026-12725) An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions. (CVE-2026-12969)

These are all security issues fixed in the dnsmasq-2.93-2.1 package on the GA media of openSUSE Tumbleweed.

This update for dnsmasq fixes the following issues

• CVE-2026-12969: out-of-bounds read in find_soa() due to missing extrabytes validation (bsc#1268882).

This update for dnsmasq fixes the following issues

• CVE-2026-12725: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies (bsc#1268764).
• CVE-2026-12969: out-of-bounds read in find_soa() due to missing extrabytes validation (bsc#1268882).

Changes for dnsmasq:

• Update to 2.93:

• Fix a corner-case in DNSSEC validation with wildcards.
• Fix DNSSEC failure with spurious RRSIGs.
• Fix DNSSEC fail with CNAME replies to DS queries.
• Fix regression in 2.92 release which broke DHCPv6 when a DHCP relay is in use.
• Modify the inotify implementation so that inotify watches are only created after dnsmasq has changed permissions and userid.

This update for dnsmasq fixes the following issues

• CVE-2026-12725: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies (bsc#1268764).
• CVE-2026-12969: out-of-bounds read in find_soa() due to missing extrabytes validation (bsc#1268882).

Changes for dnsmasq:

• Update to 2.93:

• Fix a corner-case in DNSSEC validation with wildcards.
• Fix DNSSEC failure with spurious RRSIGs.
• Fix DNSSEC fail with CNAME replies to DS queries.
• Fix regression in 2.92 release which broke DHCPv6 when a DHCP relay is in use.
• Modify the inotify implementation so that inotify watches are only created after dnsmasq has changed permissions and userid.

This update for dnsmasq fixes the following issues

• CVE-2026-12725: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies (bsc#1268764).
• CVE-2026-12969: out-of-bounds read in find_soa() due to missing extrabytes validation (bsc#1268882).

Changes for dnsmasq:

• Update to 2.93:

• Fix a corner-case in DNSSEC validation with wildcards.
• Fix DNSSEC failure with spurious RRSIGs.
• Fix DNSSEC fail with CNAME replies to DS queries.
• Fix regression in 2.92 release which broke DHCPv6 when a DHCP relay is in use.
• Modify the inotify implementation so that inotify watches are only created after dnsmasq has changed permissions and userid.

Yiwei Hou discovered that Dnsmasq incorrectly handled logging of DS or DNSKEY. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-12725)

It was discovered that Dnsmasq incorrectly validated the length of fixed-length DNS record fields when parsing NS section records. A remote attacker could possibly use this issue to cause Dnsmasq to read out of bounds, possibly exposing sensitive information. (CVE-2026-12969)