CVE-2026-93007
Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation
A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation
A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.
- Record
CVE-2026-93007- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-06
EUVDEUVD-2026-112790
A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.
- Record
EUVD-2026-112790- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-2frf-fr59-fcjq
A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and...
A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.
- Record
GHSA-2frf-fr59-fcjq- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.
- Record
CVE-2026-93007- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-93007
A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.
- Record
DEBIAN-CVE-2026-93007- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-93007
A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.
- Record
UBUNTU-CVE-2026-93007- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-05
OSVAZL-112418 No score
CVE-2026-93007 affecting package dnsmasq 2.93-1
A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.
- Record
AZL-112418- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:12415-1 No score
dnsmasq-2.93-3.1 on GA media
These are all security issues fixed in the dnsmasq-2.93-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12415-1- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dnsmasqAzure Linux:3 |
through 2.93-1 | None known |
dnsmasqDebian:12 |
All versions, plus listed versions 2.89-12.90-12.90-22.90-32.90-4 Show 20 moreShow less2.90-4~deb12u12.90-4~deb12u22.90-52.90-62.90-72.91-12.91~test6-12.91~test9-12.92-12.92-1+exp12.92-1~exp12.92-22.92-32.92-42.92-52.92~rc1-12.92~rc3-12.93-12.93-22.93-3 |
None known |
dnsmasqDebian:13 |
All versions, plus listed versions 2.91-12.91-1+deb13u12.91-1+deb13u22.92-12.92-1+exp1 Show 10 moreShow less2.92-1~exp12.92-22.92-32.92-42.92-52.92~rc1-12.92~rc3-12.93-12.93-22.93-3 |
None known |
dnsmasqDebian:14 |
All versions, plus listed versions 2.91-12.92-12.92-1+exp12.92-1~exp12.92-2 Show 8 moreShow less2.92-32.92-42.92-52.92~rc1-12.92~rc3-12.93-12.93-22.93-3 |
None known |
dnsmasqUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.66-4ubuntu12.67-12.68-12.68-1ubuntu0.12.68-1ubuntu0.2 Show 5 moreShow less2.68-1ubuntu0.2+esm12.68-1ubuntu0.2+esm22.68-1ubuntu0.2+esm32.68-1ubuntu0.2+esm52.68-1ubuntu0.2+esm6 |
None known |
dnsmasqUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.75-12.75-1ubuntu0.16.04.12.75-1ubuntu0.16.04.22.75-1ubuntu0.16.04.32.75-1ubuntu0.16.04.4 Show 10 moreShow less2.75-1ubuntu0.16.04.52.75-1ubuntu0.16.04.72.75-1ubuntu0.16.04.82.75-1ubuntu0.16.04.102.75-1ubuntu0.16.04.10+esm12.79-1ubuntu0.16.04.1+esm12.79-1ubuntu0.16.04.1+esm22.90-0ubuntu0.16.04.1+esm12.90-0ubuntu0.16.04.1+esm32.90-0ubuntu0.16.04.1+esm4 |
None known |
dnsmasqUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.78-12.78-32.79-12.79-1ubuntu0.22.79-1ubuntu0.3 Show 7 moreShow less2.79-1ubuntu0.42.79-1ubuntu0.52.79-1ubuntu0.62.79-1ubuntu0.72.90-0ubuntu0.18.04.1+esm12.90-0ubuntu0.18.04.1+esm32.90-0ubuntu0.18.04.1+esm4 |
None known |
dnsmasqUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.80-1ubuntu22.80-1ubuntu42.80-1.1ubuntu12.80-1.1ubuntu1.22.80-1.1ubuntu1.3 Show 7 moreShow less2.80-1.1ubuntu1.42.80-1.1ubuntu1.52.80-1.1ubuntu1.62.80-1.1ubuntu1.72.90-0ubuntu0.20.04.12.90-0ubuntu0.20.04.1+esm22.90-0ubuntu0.20.04.1+esm3 |
None known |
dnsmasqUbuntu:22.04:LTS |
All versions, plus listed versions 2.85-1ubuntu22.86-1.12.86-1.1ubuntu0.12.86-1.1ubuntu0.22.86-1.1ubuntu0.3 Show 7 moreShow less2.86-1.1ubuntu0.42.86-1.1ubuntu0.52.90-0ubuntu0.22.04.12.90-0ubuntu0.22.04.32.90-0ubuntu0.22.04.42.91-0ubuntu0.22.04.12.91-0ubuntu0.22.04.2 |
None known |
dnsmasqUbuntu:24.04:LTS |
All versions, plus listed versions 2.89-12.90-22.90-2build12.90-2build22.90-2ubuntu0.1 Show 4 moreShow less2.90-2ubuntu0.32.90-2ubuntu0.42.91-0ubuntu0.24.04.12.91-0ubuntu0.24.04.2 |
None known |
dnsmasqUbuntu:26.10 |
All versions, plus listed versions 2.92-12.93-12.93-3ubuntu1 |
None known |
dnsmasqUbuntu:26.04:LTS |
All versions, plus listed versions 2.91-1build12.92~rc3-12.92-12.92-1ubuntu0.22.92-1ubuntu0.32.92-1ubuntu0.42.92-1ubuntu0.5 |
None known |
dnsmasqopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 2.93-3.1 | 2.93-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | CVE List, EUVD, NVD | |
| affected, aliases, facts, references | OSV | |
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-93007 is a medium vulnerability (CVSS 5.3) in Red Hat Ceph Storage 9, published October 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. No source names a fixed version.