Every CVE Search/ Get API key

CVE-2026-6507

Dnsmasq: dnsmasq: denial of service due to out-of-bounds write in dhcp bootreply processing

7.5 HighFix available

A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability by sending a specially crafted BOOTREPLY (Bootstrap Protocol Reply) packet to a dnsmasq server configured with the --dhcp-split-relay option. This can lead to memory corruption, causing the dnsmasq daemon to crash and resulting in a denial of service (DoS).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.48%Up 0.4 points since Apr 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Dnsmasq: dnsmasq: denial of service due to out-of-bounds write in dhcp bootreply processing

A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability by sending a specially crafted BOOTREPLY (Bootstrap Protocol Reply) packet to a dnsmasq server configured with the --dhcp-split-relay option. This can lead to memory corruption, causing the dnsmasq daemon to crash and resulting in a denial of service (DoS).

Record
CVE-2026-6507
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-05
EUVDEUVD-2026-23419 7.5

A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability by sending a specially crafted BOOTREPLY (Bootstrap Protocol Reply) packet to a dnsmasq server configured with the --dhcp-split-relay option. This can lead to memory corruption, causing the dnsmasq daemon to crash and resulting in a denial of service (DoS).

Record
EUVD-2026-23419
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
GitHub AdvisoriesGHSA-28hj-3gj2-63m5 7.5

A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability...

A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability by sending a specially crafted BOOTREPLY (Bootstrap Protocol Reply) packet to a dnsmasq server configured with the --dhcp-split-relay option. This can lead to memory corruption, causing the dnsmasq daemon to crash and resulting in a denial of service (DoS).

Record
GHSA-28hj-3gj2-63m5
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 7.5

A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability by sending a specially crafted BOOTREPLY (Bootstrap Protocol Reply) packet to a dnsmasq server configured with the --dhcp-split-relay option. This can lead to memory corruption, causing the dnsmasq daemon to crash and resulting in a denial of service (DoS).

Record
CVE-2026-6507
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-05
OSVDEBIAN-CVE-2026-6507 7.5

A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability by sending a specially crafted BOOTREPLY (Bootstrap Protocol Reply) packet to a dnsmasq server configured with the --dhcp-split-relay option. This can lead to memory corruption, causing the dnsmasq daemon to crash and resulting in a denial of service (DoS).

Record
DEBIAN-CVE-2026-6507
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-6507 7.5

A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability by sending a specially crafted BOOTREPLY (Bootstrap Protocol Reply) packet to a dnsmasq server configured with the --dhcp-split-relay option. This can lead to memory corruption, causing the dnsmasq daemon to crash and resulting in a denial of service (DoS).

Record
UBUNTU-CVE-2026-6507
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 12 moreShow less
OSVopenSUSE-SU-2026:10605-1 No score

dnsmasq-2.92-3.1 on GA media

These are all security issues fixed in the dnsmasq-2.92-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10605-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20748-1 No score

Security update for dnsmasq

This update for dnsmasq fixes the following issues

Security issues:

  • CVE-2026-2291: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect (bsc#1258251).
  • CVE-2026-4890: DoS vulnerability in the DNSSEC validation (bsc#1265001).
  • CVE-2026-4891: heap-based out-of-bounds read vulnerability in the DNSSEC validation (bsc#1265002).
  • CVE-2026-4892: heap-based out-of-bounds write vulnerability in the DHCPv6 implementation (bsc#1265003).
  • CVE-2026-4893: information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks (bsc#1265004).
  • CVE-2026-5172: buffer overflow in dnsmasq's extract_addresses() function (bsc#1265006).
  • CVE-2026-6507: out-of-bounds write in DHCP BOOTREPLY processing can lead to denial of service (bsc#1262487).

Non security issues:

  • aardvark-dns upstream tests make dnsmasq dump core (bsc#1247812).
  • Drop rcFOO symlinks for CODE16 (jsc#PED-266.
  • libnettle: update to 4.0 breaks dnsmasq and gnutls (bsc#1257934).
  • unknown user or group: dnsmasq with latest proposed dnsmasq update when doing virsh net-start (bsc#1235517).
  • Update to security release 2.92rel2.
Record
openSUSE-SU-2026:20748-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21192-1 No score

Security update for dnsmasq

This update for dnsmasq fixes the following issues

Update to 2.93:

  • CVE-2026-12725: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies (bsc#1268764).

Changes for dnsmasq:

  • CVE-2026-12725, bsc#1268764: Heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies.
  • Fix a corner-case in DNSSEC validation with wildcards.
  • Fix DNSSEC failure with spurious RRSIGs.
  • Fix DNSSEC fail with CNAME replies to DS queries.
  • Fix regression in 2.92 release which broke DHCPv6 when a DHCP relay is in use.
  • Modify the inotify implementation so that inotify watches are only created after dnsmasq has changed permissions and userid.
  • CVE-2026-2291: Rework storage allocation for domain names.
Record
openSUSE-SU-2026:21192-1
Updated
2026-11-02
OSVSUSE-SU-2026:1934-1 No score

Security update for dnsmasq

This update for dnsmasq fixes the following issues

Security issues:

  • CVE-2026-4890: DoS vulnerability in the DNSSEC validation (bsc#1265001).
  • CVE-2026-4891: heap-based out-of-bounds read vulnerability in the DNSSEC validation (bsc#1265002).
  • CVE-2026-4892: heap-based out-of-bounds write vulnerability in the DHCPv6 implementation (bsc#1265003).
  • CVE-2026-4893: information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks (bsc#1265004).
  • CVE-2026-5172: buffer overflow in dnsmasq's extract_addresses() function (bsc#1265006).
  • CVE-2026-6507: out-of-bounds write in DHCP BOOTREPLY processing can lead to denial of service (bsc#1262487).

Non security issues:

  • Updated to security release 2.92rel2.
  • aardvark-dns upstream tests make dnsmasq dump core (bsc#1247812).
  • Drop rcFOO symlinks for CODE16 (jsc#PED-266).
  • libnettle: update to 4.0 breaks dnsmasq and gnutls (bsc#1257934).
Record
SUSE-SU-2026:1934-1
Updated
2026-11-02
OSVSUSE-SU-2026:21640-1 No score

Security update for dnsmasq

This update for dnsmasq fixes the following issues

Security issues:

  • CVE-2026-2291: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect (bsc#1258251).
  • CVE-2026-4890: DoS vulnerability in the DNSSEC validation (bsc#1265001).
  • CVE-2026-4891: heap-based out-of-bounds read vulnerability in the DNSSEC validation (bsc#1265002).
  • CVE-2026-4892: heap-based out-of-bounds write vulnerability in the DHCPv6 implementation (bsc#1265003).
  • CVE-2026-4893: information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks (bsc#1265004).
  • CVE-2026-5172: buffer overflow in dnsmasq's extract_addresses() function (bsc#1265006).
  • CVE-2026-6507: out-of-bounds write in DHCP BOOTREPLY processing can lead to denial of service (bsc#1262487).

Non security issues:

  • aardvark-dns upstream tests make dnsmasq dump core (bsc#1247812).
  • Drop rcFOO symlinks for CODE16 (jsc#PED-266.
  • libnettle: update to 4.0 breaks dnsmasq and gnutls (bsc#1257934).
  • unknown user or group: dnsmasq with latest proposed dnsmasq update when doing virsh net-start (bsc#1235517).
  • Update to security release 2.92rel2.
Record
SUSE-SU-2026:21640-1
Updated
2026-11-02
OSVSUSE-SU-2026:21677-1 No score

Security update for dnsmasq

This update for dnsmasq fixes the following issues

Security issues:

  • CVE-2026-2291: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect (bsc#1258251).
  • CVE-2026-4890: DoS vulnerability in the DNSSEC validation (bsc#1265001).
  • CVE-2026-4891: heap-based out-of-bounds read vulnerability in the DNSSEC validation (bsc#1265002).
  • CVE-2026-4892: heap-based out-of-bounds write vulnerability in the DHCPv6 implementation (bsc#1265003).
  • CVE-2026-4893: information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks (bsc#1265004).
  • CVE-2026-5172: buffer overflow in dnsmasq's extract_addresses() function (bsc#1265006).
  • CVE-2026-6507: out-of-bounds write in DHCP BOOTREPLY processing can lead to denial of service (bsc#1262487).

Non security issues:

  • aardvark-dns upstream tests make dnsmasq dump core (bsc#1247812).
  • Drop rcFOO symlinks for CODE16 (jsc#PED-266).
  • libnettle: update to 4.0 breaks dnsmasq and gnutls (bsc#1257934).

Changes for dnsmasq:

  • Update to security release 2.92rel2
Record
SUSE-SU-2026:21677-1
Updated
2026-11-02
OSVSUSE-SU-2026:21733-1 No score

Security update for dnsmasq

This update for dnsmasq fixes the following issues

Security issues:

  • CVE-2026-2291: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect (bsc#1258251).
  • CVE-2026-4890: DoS vulnerability in the DNSSEC validation (bsc#1265001).
  • CVE-2026-4891: heap-based out-of-bounds read vulnerability in the DNSSEC validation (bsc#1265002).
  • CVE-2026-4892: heap-based out-of-bounds write vulnerability in the DHCPv6 implementation (bsc#1265003).
  • CVE-2026-4893: information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks (bsc#1265004).
  • CVE-2026-5172: buffer overflow in dnsmasq's extract_addresses() function (bsc#1265006).
  • CVE-2026-6507: out-of-bounds write in DHCP BOOTREPLY processing can lead to denial of service (bsc#1262487).

Non security issues:

  • aardvark-dns upstream tests make dnsmasq dump core (bsc#1247812).
  • Drop rcFOO symlinks for CODE16 (jsc#PED-266).
  • libnettle: update to 4.0 breaks dnsmasq and gnutls (bsc#1257934).

Changes for dnsmasq:

  • Update to security release 2.92rel2
Record
SUSE-SU-2026:21733-1
Updated
2026-11-02
OSVSUSE-SU-2026:21788-1 No score

Security update for dnsmasq

This update for dnsmasq fixes the following issues

Security issues:

  • CVE-2026-2291: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect (bsc#1258251).
  • CVE-2026-4890: DoS vulnerability in the DNSSEC validation (bsc#1265001).
  • CVE-2026-4891: heap-based out-of-bounds read vulnerability in the DNSSEC validation (bsc#1265002).
  • CVE-2026-4892: heap-based out-of-bounds write vulnerability in the DHCPv6 implementation (bsc#1265003).
  • CVE-2026-4893: information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks (bsc#1265004).
  • CVE-2026-5172: buffer overflow in dnsmasq's extract_addresses() function (bsc#1265006).
  • CVE-2026-6507: out-of-bounds write in DHCP BOOTREPLY processing can lead to denial of service (bsc#1262487).

Non security issues:

  • aardvark-dns upstream tests make dnsmasq dump core (bsc#1247812).
  • Drop rcFOO symlinks for CODE16 (jsc#PED-266.
  • libnettle: update to 4.0 breaks dnsmasq and gnutls (bsc#1257934).
  • unknown user or group: dnsmasq with latest proposed dnsmasq update when doing virsh net-start (bsc#1235517).
  • Update to security release 2.92rel2.
Record
SUSE-SU-2026:21788-1
Updated
2026-11-02
OSVSUSE-SU-2026:22454-1 No score

Security update for dnsmasq

This update for dnsmasq fixes the following issues

Update to 2.93:

  • CVE-2026-12725: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies (bsc#1268764).
Record
SUSE-SU-2026:22454-1
Updated
2026-11-02
OSVSUSE-SU-2026:22496-1 No score

Security update for dnsmasq

This update for dnsmasq fixes the following issues

Update to 2.93:

  • CVE-2026-12725: heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies (bsc#1268764).

Changes for dnsmasq:

  • CVE-2026-12725, bsc#1268764: Heap buffer overflow in log_query() when logging unsupported DS/DNSKEY replies.
  • Fix a corner-case in DNSSEC validation with wildcards.
  • Fix DNSSEC failure with spurious RRSIGs.
  • Fix DNSSEC fail with CNAME replies to DS queries.
  • Fix regression in 2.92 release which broke DHCPv6 when a DHCP relay is in use.
  • Modify the inotify implementation so that inotify watches are only created after dnsmasq has changed permissions and userid.
  • CVE-2026-2291: Rework storage allocation for domain names.
Record
SUSE-SU-2026:22496-1
Updated
2026-11-02
OSVSUSE-SU-2026:2458-1 No score

Security update for dnsmasq

This update for dnsmasq fixes the following issues

  • CVE-2026-2291: VU#471747: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect (bsc#1258251).
  • CVE-2026-4890: DoS vulnerability in the DNSSEC validation (bsc#1265001).
  • CVE-2026-4891: heap-based out-of-bounds read vulnerability in the DNSSEC validation (bsc#1265002).
  • CVE-2026-4892: heap-based out-of-bounds write vulnerability in the DHCPv6 implementation (bsc#1265003).
  • CVE-2026-4893: information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks (bsc#1265004).
  • CVE-2026-5172: buffer overflow in dnsmasq's extract_addresses() function (bsc#1265006).
  • CVE-2026-6507: out-of-bounds write in DHCP BOOTREPLY processing can lead to denial of service (bsc#1262487).

Changes for dnsmasq:

  • Update to security release 2.92rel2.
  • Fix setting of compile time options from the spec file.
Record
SUSE-SU-2026:2458-1
Updated
2026-11-02
OSVUSN-8308-1 No score

dnsmasq vulnerability

It was discovered that Dnsmasq incorrectly handled BOOTREPLY packets when configured with the --dhcp-split-relay option. A remote attacker could use this issue to cause Dnsmasq to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-8308-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dnsmasq
Debian:14
 before 2.92-4, plus listed versions
2.91-12.92-12.92-1+exp12.92-1~exp12.92-22.92-32.92~rc1-12.92~rc3-1
2.92-4
dnsmasq
SUSE:Linux Micro 6.1
From an advisory covering 3 CVEs
 before 2.93-slfo.1.1_1.1
2.93-slfo.1.1_1.1
dnsmasq
SUSE:Linux Enterprise Server 16.0
From an advisory covering 3 CVEs
 before 2.93-160000.1.1
2.93-160000.1.1
dnsmasq
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 3 CVEs
 before 2.93-160000.1.1
2.93-160000.1.1
dnsmasq
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 7 CVEs
 before 2.92rel2-18.27.1
2.92rel2-18.27.1
dnsmasq
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 7 CVEs
 before 2.92rel2-18.27.1
2.92rel2-18.27.1
dnsmasq
Ubuntu:26.04:LTS
 before 2.92-1ubuntu0.3, plus listed versions
2.91-1build12.92~rc3-12.92-12.92-1ubuntu0.2
2.92-1ubuntu0.3
dnsmasq
openSUSE:Tumbleweed
 before 2.92-3.1
2.92-3.1
dnsmasq
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 2.93-160000.1.1
2.93-160000.1.1

History

History
RecordedChangedSources
affectedCVE List, NVD
factsEUVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-6507 is a high vulnerability (CVSS 7.5) in Red Hat Enterprise Linux 10, published April 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in dnsmasq 2.92-4.

References

Show 30 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open