CVE-2026-93011
Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.
- Record
CVE-2026-93011- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-787
- Updated
- 2026-11-06
EUVDEUVD-2026-112789
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.
- Record
EUVD-2026-112789- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-2jq5-wc7q-j2fc
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC...
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.
- Record
GHSA-2jq5-wc7q-j2fc- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.
- Record
CVE-2026-93011- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-787
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-93011
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.
- Record
DEBIAN-CVE-2026-93011- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-93011
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.
- Record
UBUNTU-CVE-2026-93011- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-05
OSVAZL-112421 No score
CVE-2026-93011 affecting package dnsmasq 2.93-1
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.
- Record
AZL-112421- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:12415-1 No score
dnsmasq-2.93-3.1 on GA media
These are all security issues fixed in the dnsmasq-2.93-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12415-1- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dnsmasqAzure Linux:3 |
through 2.93-1 | None known |
dnsmasqDebian:12 |
All versions, plus listed versions 2.89-12.90-12.90-22.90-32.90-4 Show 20 moreShow less2.90-4~deb12u12.90-4~deb12u22.90-52.90-62.90-72.91-12.91~test6-12.91~test9-12.92-12.92-1+exp12.92-1~exp12.92-22.92-32.92-42.92-52.92~rc1-12.92~rc3-12.93-12.93-22.93-3 |
None known |
dnsmasqDebian:13 |
All versions, plus listed versions 2.91-12.91-1+deb13u12.91-1+deb13u22.92-12.92-1+exp1 Show 10 moreShow less2.92-1~exp12.92-22.92-32.92-42.92-52.92~rc1-12.92~rc3-12.93-12.93-22.93-3 |
None known |
dnsmasqDebian:14 |
All versions, plus listed versions 2.91-12.92-12.92-1+exp12.92-1~exp12.92-2 Show 8 moreShow less2.92-32.92-42.92-52.92~rc1-12.92~rc3-12.93-12.93-22.93-3 |
None known |
dnsmasqUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.66-4ubuntu12.67-12.68-12.68-1ubuntu0.12.68-1ubuntu0.2 Show 5 moreShow less2.68-1ubuntu0.2+esm12.68-1ubuntu0.2+esm22.68-1ubuntu0.2+esm32.68-1ubuntu0.2+esm52.68-1ubuntu0.2+esm6 |
None known |
dnsmasqUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.75-12.75-1ubuntu0.16.04.12.75-1ubuntu0.16.04.22.75-1ubuntu0.16.04.32.75-1ubuntu0.16.04.4 Show 10 moreShow less2.75-1ubuntu0.16.04.52.75-1ubuntu0.16.04.72.75-1ubuntu0.16.04.82.75-1ubuntu0.16.04.102.75-1ubuntu0.16.04.10+esm12.79-1ubuntu0.16.04.1+esm12.79-1ubuntu0.16.04.1+esm22.90-0ubuntu0.16.04.1+esm12.90-0ubuntu0.16.04.1+esm32.90-0ubuntu0.16.04.1+esm4 |
None known |
dnsmasqUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.78-12.78-32.79-12.79-1ubuntu0.22.79-1ubuntu0.3 Show 7 moreShow less2.79-1ubuntu0.42.79-1ubuntu0.52.79-1ubuntu0.62.79-1ubuntu0.72.90-0ubuntu0.18.04.1+esm12.90-0ubuntu0.18.04.1+esm32.90-0ubuntu0.18.04.1+esm4 |
None known |
dnsmasqUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.80-1ubuntu22.80-1ubuntu42.80-1.1ubuntu12.80-1.1ubuntu1.22.80-1.1ubuntu1.3 Show 7 moreShow less2.80-1.1ubuntu1.42.80-1.1ubuntu1.52.80-1.1ubuntu1.62.80-1.1ubuntu1.72.90-0ubuntu0.20.04.12.90-0ubuntu0.20.04.1+esm22.90-0ubuntu0.20.04.1+esm3 |
None known |
dnsmasqUbuntu:22.04:LTS |
All versions, plus listed versions 2.85-1ubuntu22.86-1.12.86-1.1ubuntu0.12.86-1.1ubuntu0.22.86-1.1ubuntu0.3 Show 7 moreShow less2.86-1.1ubuntu0.42.86-1.1ubuntu0.52.90-0ubuntu0.22.04.12.90-0ubuntu0.22.04.32.90-0ubuntu0.22.04.42.91-0ubuntu0.22.04.12.91-0ubuntu0.22.04.2 |
None known |
dnsmasqUbuntu:24.04:LTS |
All versions, plus listed versions 2.89-12.90-22.90-2build12.90-2build22.90-2ubuntu0.1 Show 4 moreShow less2.90-2ubuntu0.32.90-2ubuntu0.42.91-0ubuntu0.24.04.12.91-0ubuntu0.24.04.2 |
None known |
dnsmasqUbuntu:26.10 |
All versions, plus listed versions 2.92-12.93-12.93-3ubuntu1 |
None known |
dnsmasqUbuntu:26.04:LTS |
All versions, plus listed versions 2.91-1build12.92~rc3-12.92-12.92-1ubuntu0.22.92-1ubuntu0.32.92-1ubuntu0.42.92-1ubuntu0.5 |
None known |
dnsmasqopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 2.93-3.1 | 2.93-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | CVE List, EUVD, NVD | |
| affected, aliases, facts, references | OSV | |
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-93011 is a medium vulnerability (CVSS 5.3) in Red Hat Ceph Storage 9, published October 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. No source names a fixed version.