CVE-2026-93009
Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.
- Record
CVE-2026-93009- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-06
EUVDEUVD-2026-112826
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.
- Record
EUVD-2026-112826- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-6qrc-rpqw-59wp
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of...
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.
- Record
GHSA-6qrc-rpqw-59wp- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.
- Record
CVE-2026-93009- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-93009
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.
- Record
DEBIAN-CVE-2026-93009- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-07
OSVUBUNTU-CVE-2026-93009
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.
- Record
UBUNTU-CVE-2026-93009- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-05
OSVAZL-112430 No score
CVE-2026-93009 affecting package dnsmasq 2.93-1
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.
- Record
AZL-112430- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:12415-1 No score
dnsmasq-2.93-3.1 on GA media
These are all security issues fixed in the dnsmasq-2.93-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12415-1- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dnsmasqAzure Linux:3 |
through 2.93-1 | None known |
dnsmasqDebian:12 |
All versions, plus listed versions 2.89-12.90-12.90-22.90-32.90-4 Show 20 moreShow less2.90-4~deb12u12.90-4~deb12u22.90-52.90-62.90-72.91-12.91~test6-12.91~test9-12.92-12.92-1+exp12.92-1~exp12.92-22.92-32.92-42.92-52.92~rc1-12.92~rc3-12.93-12.93-22.93-3 |
None known |
dnsmasqDebian:13 |
All versions, plus listed versions 2.91-12.91-1+deb13u12.91-1+deb13u22.92-12.92-1+exp1 Show 10 moreShow less2.92-1~exp12.92-22.92-32.92-42.92-52.92~rc1-12.92~rc3-12.93-12.93-22.93-3 |
None known |
dnsmasqDebian:14 |
All versions, plus listed versions 2.91-12.92-12.92-1+exp12.92-1~exp12.92-2 Show 8 moreShow less2.92-32.92-42.92-52.92~rc1-12.92~rc3-12.93-12.93-22.93-3 |
None known |
dnsmasqUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.66-4ubuntu12.67-12.68-12.68-1ubuntu0.12.68-1ubuntu0.2 Show 5 moreShow less2.68-1ubuntu0.2+esm12.68-1ubuntu0.2+esm22.68-1ubuntu0.2+esm32.68-1ubuntu0.2+esm52.68-1ubuntu0.2+esm6 |
None known |
dnsmasqUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.75-12.75-1ubuntu0.16.04.12.75-1ubuntu0.16.04.22.75-1ubuntu0.16.04.32.75-1ubuntu0.16.04.4 Show 10 moreShow less2.75-1ubuntu0.16.04.52.75-1ubuntu0.16.04.72.75-1ubuntu0.16.04.82.75-1ubuntu0.16.04.102.75-1ubuntu0.16.04.10+esm12.79-1ubuntu0.16.04.1+esm12.79-1ubuntu0.16.04.1+esm22.90-0ubuntu0.16.04.1+esm12.90-0ubuntu0.16.04.1+esm32.90-0ubuntu0.16.04.1+esm4 |
None known |
dnsmasqUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.78-12.78-32.79-12.79-1ubuntu0.22.79-1ubuntu0.3 Show 7 moreShow less2.79-1ubuntu0.42.79-1ubuntu0.52.79-1ubuntu0.62.79-1ubuntu0.72.90-0ubuntu0.18.04.1+esm12.90-0ubuntu0.18.04.1+esm32.90-0ubuntu0.18.04.1+esm4 |
None known |
dnsmasqUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.80-1ubuntu22.80-1ubuntu42.80-1.1ubuntu12.80-1.1ubuntu1.22.80-1.1ubuntu1.3 Show 7 moreShow less2.80-1.1ubuntu1.42.80-1.1ubuntu1.52.80-1.1ubuntu1.62.80-1.1ubuntu1.72.90-0ubuntu0.20.04.12.90-0ubuntu0.20.04.1+esm22.90-0ubuntu0.20.04.1+esm3 |
None known |
dnsmasqUbuntu:22.04:LTS |
All versions, plus listed versions 2.85-1ubuntu22.86-1.12.86-1.1ubuntu0.12.86-1.1ubuntu0.22.86-1.1ubuntu0.3 Show 7 moreShow less2.86-1.1ubuntu0.42.86-1.1ubuntu0.52.90-0ubuntu0.22.04.12.90-0ubuntu0.22.04.32.90-0ubuntu0.22.04.42.91-0ubuntu0.22.04.12.91-0ubuntu0.22.04.2 |
None known |
dnsmasqUbuntu:24.04:LTS |
All versions, plus listed versions 2.89-12.90-22.90-2build12.90-2build22.90-2ubuntu0.1 Show 4 moreShow less2.90-2ubuntu0.32.90-2ubuntu0.42.91-0ubuntu0.24.04.12.91-0ubuntu0.24.04.2 |
None known |
dnsmasqUbuntu:26.10 |
All versions, plus listed versions 2.92-12.93-12.93-3ubuntu1 |
None known |
dnsmasqUbuntu:26.04:LTS |
All versions, plus listed versions 2.91-1build12.92~rc3-12.92-12.92-1ubuntu0.22.92-1ubuntu0.32.92-1ubuntu0.42.92-1ubuntu0.5 |
None known |
dnsmasqopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 2.93-3.1 | 2.93-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, facts, references | EUVD, NVD, OSV | |
| facts | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-93009 is a medium vulnerability (CVSS 4.3) in Red Hat Ceph Storage 9, published October 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. No source names a fixed version.