{"id":"CVE-2023-49441","aliases":["DEBIAN-CVE-2023-49441","EUVD-2023-53405","GHSA-wh73-785p-7wcf","OESA-2024-1903","OESA-2024-1904","OESA-2024-1905","SUSE-SU-2026:21626-1","UBUNTU-CVE-2023-49441","openSUSE-SU-2024:14031-1"],"status":"published","title":"dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.","description":"dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00656,"percentile":0.51916,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2024-06-06T21:20:59Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"Debian:12","package":"dnsmasq","fixed_in":["2.90-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dnsmasq","fixed_in":["2.90-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dnsmasq","fixed_in":["2.90-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"dnsmasq","fixed_in":["2.86-8.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"dnsmasq","fixed_in":["2.82-15.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"dnsmasq","fixed_in":["2.86-8.oe2203sp1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dnsmasq","fixed_in":["2.90-0ubuntu0.16.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dnsmasq","fixed_in":["2.90-0ubuntu0.18.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"dnsmasq","fixed_in":["2.90-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"dnsmasq","fixed_in":["2.90-0ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"dnsmasq","fixed_in":["2.90-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-1"}]}],"versions":["2.89-1"]},{"source":"osv","ecosystem":"Debian:13","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.86-8.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.82-15.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.86-8.oe2203sp1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.16.04.1+esm1"}]}],"versions":["2.75-1","2.75-1ubuntu0.16.04.1","2.75-1ubuntu0.16.04.2","2.75-1ubuntu0.16.04.3","2.75-1ubuntu0.16.04.4","2.75-1ubuntu0.16.04.5","2.75-1ubuntu0.16.04.7","2.75-1ubuntu0.16.04.8","2.75-1ubuntu0.16.04.10","2.75-1ubuntu0.16.04.10+esm1","2.79-1ubuntu0.16.04.1+esm1","2.79-1ubuntu0.16.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.18.04.1+esm1"}]}],"versions":["2.78-1","2.78-3","2.79-1","2.79-1ubuntu0.2","2.79-1ubuntu0.3","2.79-1ubuntu0.4","2.79-1ubuntu0.5","2.79-1ubuntu0.6","2.79-1ubuntu0.7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.20.04.1"}]}],"versions":["2.80-1ubuntu2","2.80-1ubuntu4","2.80-1.1ubuntu1","2.80-1.1ubuntu1.2","2.80-1.1ubuntu1.3","2.80-1.1ubuntu1.4","2.80-1.1ubuntu1.5","2.80-1.1ubuntu1.6","2.80-1.1ubuntu1.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.22.04.1"}]}],"versions":["2.85-1ubuntu2","2.86-1.1","2.86-1.1ubuntu0.1","2.86-1.1ubuntu0.2","2.86-1.1ubuntu0.3","2.86-1.1ubuntu0.4","2.86-1.1ubuntu0.5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-2.1"}]}]}],"products":[{"vendor":"thekelleys","product":"dnsmasq"}],"references":[{"url":"https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2023q4/017332.html","tags":["x_transferred","Exploit","Mailing List","web","report"]},{"url":"https://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=65c2d6afd67a032f45f40d7e4d620f5d73e5f07d","tags":["x_transferred","Broken Link","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49441","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wh73-785p-7wcf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49441.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-49441","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1903","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1904","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1905","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621626-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1226091","tags":["report"]},{"url":"https://bugzilla.suse.com/1235517","tags":["report"]},{"url":"https://bugzilla.suse.com/1235834","tags":["report"]},{"url":"https://bugzilla.suse.com/1258251","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2291","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-49441","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49441","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-49441","description":"dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.","status":"published","published":"2024-06-06T21:20:59.871Z","modified":"2025-03-14T15:19:01.559Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:35:12.998024Z"}],"euvd":[{"id":"EUVD-2023-53405","description":"dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.","status":"published","published":"2024-06-06T21:20:59Z","modified":"2025-03-14T15:19:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:03.250545Z"}],"ghsa":[{"id":"GHSA-wh73-785p-7wcf","title":"dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.","description":"dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.","status":"published","published":"2024-06-07T00:30:36Z","modified":"2024-10-10T21:31:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:58:29.079883Z"}],"nvd":[{"id":"CVE-2023-49441","description":"dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.","status":"published","published":"2024-06-06T22:15:09.843Z","modified":"2026-06-17T06:36:00.15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:09:17.205287Z"}],"osv":[{"id":"CVE-2023-49441","description":"dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.","status":"published","published":"2024-06-06T21:20:59.871Z","modified":"2026-10-28T02:30:54.044407271Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"DEBIAN-CVE-2023-49441","description":"dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.","status":"published","published":"2024-06-06T22:15:09.843Z","modified":"2026-10-26T18:02:35.136924787Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"OESA-2024-1903","title":"dnsmasq security update","description":"Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.\r\n\r\nSecurity Fix(es):\r\n\r\ndnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.(CVE-2023-49441)","status":"published","published":"2024-07-26T11:07:22Z","modified":"2026-08-18T01:18:31.302565665Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-1904","title":"dnsmasq security update","description":"Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.\r\n\r\nSecurity Fix(es):\r\n\r\ndnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.(CVE-2023-49441)","status":"published","published":"2024-07-26T11:07:22Z","modified":"2026-08-18T01:18:31.265211323Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-1905","title":"dnsmasq security update","description":"Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.\r\n\r\nSecurity Fix(es):\r\n\r\ndnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.(CVE-2023-49441)","status":"published","published":"2024-07-26T11:07:22Z","modified":"2026-08-18T01:18:31.275102421Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2023-49441","description":"dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.","status":"published","published":"2024-06-06T22:15:00Z","modified":"2025-08-11T04:48:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"openSUSE-SU-2024:14031-1","title":"dnsmasq-2.90-2.1 on GA media","description":"These are all security issues fixed in the dnsmasq-2.90-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:15:23.997098Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2026:21626-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues:\n\nSecurity issues:\n\n- CVE-2023-49441: integer overflow via forward_query (bsc#1226091).\n- CVE-2026-2291: VU#471747: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect\n  (bsc#1258251).\n\nNon security issue:\n\n- Reintroduce nogroup (bsc#1235517).\n","status":"published","published":"2026-05-12T09:38:42Z","modified":"2026-05-16T18:25:33.857819Z","updated_at":"2026-11-02T15:54:02.312556Z"}]}}