{"id":"CVE-2026-12969","aliases":["AZL-91164","BELL-CVE-2026-12969","DEBIAN-CVE-2026-12969","EUVD-2026-38449","GHSA-wmwj-946w-3m8w","MGASA-2026-0288","OESA-2026-2963","OESA-2026-2966","OESA-2026-3087","SUSE-SU-2026:22668-1","SUSE-SU-2026:22706-1","SUSE-SU-2026:2974-1","SUSE-SU-2026:3028-1","UBUNTU-CVE-2026-12969","USN-8542-1","openSUSE-SU-2026:11172-1"],"status":"published","title":"Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation","description":"An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00256,"percentile":0.17375,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-06-23T13:28:56Z","modified":"2026-11-06T17:57:56Z","fixes":[{"ecosystem":"Azure Linux:3","package":"dnsmasq","fixed_in":["2.93-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"dnsmasq","fixed_in":["2.90-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"dnsmasq","fixed_in":["2.91-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"dnsmasq","fixed_in":["2.93-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dnsmasq","fixed_in":["2.91-1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dnsmasq","fixed_in":["2.93-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"dnsmasq","fixed_in":["2.93-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dnsmasq","fixed_in":["2.90-0ubuntu0.16.04.1+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dnsmasq","fixed_in":["2.90-0ubuntu0.18.04.1+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dnsmasq","fixed_in":["2.90-0ubuntu0.20.04.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"dnsmasq","fixed_in":["2.90-0ubuntu0.22.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"dnsmasq","fixed_in":["2.90-2ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"dnsmasq","fixed_in":["2.92-1ubuntu0.4"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"dnsmasq","fixed_in":["2.93-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.87-r0"},{"fixed":"2.90-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.91-r0"},{"fixed":"2.91-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.89-r2"},{"fixed":"2.93-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.89-1","2.90-1","2.90-2","2.90-3","2.90-4","2.90-4~deb12u1","2.90-4~deb12u2","2.90-5","2.90-6","2.90-7","2.91-1","2.91~test6-1","2.91~test9-1","2.92-1","2.92-1+exp1","2.92-1~exp1","2.92-2","2.92-3","2.92-4","2.92-5","2.92~rc1-1","2.92~rc3-1","2.93-1","2.93-2","2.93-3"]},{"source":"osv","ecosystem":"Debian:13","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.91-1+deb13u2"}]}],"versions":["2.91-1","2.91-1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-1"}]}],"versions":["2.91-1","2.92-1","2.92-1+exp1","2.92-1~exp1","2.92-2","2.92-3","2.92-4","2.92-5","2.92~rc1-1","2.92~rc3-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-11.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-11.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-11.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-18.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-18.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-150400.16.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-150400.16.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-150400.16.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-150400.16.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-150400.16.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-150400.16.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-150400.16.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-150400.16.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-150400.16.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-150400.16.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-150400.16.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-150400.16.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-150400.16.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-150400.16.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.16.04.1+esm4"}]}],"versions":["2.75-1","2.75-1ubuntu0.16.04.1","2.75-1ubuntu0.16.04.2","2.75-1ubuntu0.16.04.3","2.75-1ubuntu0.16.04.4","2.75-1ubuntu0.16.04.5","2.75-1ubuntu0.16.04.7","2.75-1ubuntu0.16.04.8","2.75-1ubuntu0.16.04.10","2.75-1ubuntu0.16.04.10+esm1","2.79-1ubuntu0.16.04.1+esm1","2.79-1ubuntu0.16.04.1+esm2","2.90-0ubuntu0.16.04.1+esm1","2.90-0ubuntu0.16.04.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.18.04.1+esm4"}]}],"versions":["2.78-1","2.78-3","2.79-1","2.79-1ubuntu0.2","2.79-1ubuntu0.3","2.79-1ubuntu0.4","2.79-1ubuntu0.5","2.79-1ubuntu0.6","2.79-1ubuntu0.7","2.90-0ubuntu0.18.04.1+esm1","2.90-0ubuntu0.18.04.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.20.04.1+esm3"}]}],"versions":["2.80-1ubuntu2","2.80-1ubuntu4","2.80-1.1ubuntu1","2.80-1.1ubuntu1.2","2.80-1.1ubuntu1.3","2.80-1.1ubuntu1.4","2.80-1.1ubuntu1.5","2.80-1.1ubuntu1.6","2.80-1.1ubuntu1.7","2.90-0ubuntu0.20.04.1","2.90-0ubuntu0.20.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.22.04.4"}]}],"versions":["2.85-1ubuntu2","2.86-1.1","2.86-1.1ubuntu0.1","2.86-1.1ubuntu0.2","2.86-1.1ubuntu0.3","2.86-1.1ubuntu0.4","2.86-1.1ubuntu0.5","2.90-0ubuntu0.22.04.1","2.90-0ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-2ubuntu0.4"}]}],"versions":["2.89-1","2.90-2","2.90-2build1","2.90-2build2","2.90-2ubuntu0.1","2.90-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.91-1","2.91-1build1","2.91-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.92-1ubuntu0.4"}]}],"versions":["2.91-1build1","2.92~rc3-1","2.92-1","2.92-1ubuntu0.2","2.92-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.16.04.1+esm4"}]}],"versions":["2.75-1","2.75-1ubuntu0.16.04.1","2.75-1ubuntu0.16.04.2","2.75-1ubuntu0.16.04.3","2.75-1ubuntu0.16.04.4","2.75-1ubuntu0.16.04.5","2.75-1ubuntu0.16.04.7","2.75-1ubuntu0.16.04.8","2.75-1ubuntu0.16.04.10","2.75-1ubuntu0.16.04.10+esm1","2.79-1ubuntu0.16.04.1+esm1","2.79-1ubuntu0.16.04.1+esm2","2.90-0ubuntu0.16.04.1+esm1","2.90-0ubuntu0.16.04.1+esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.18.04.1+esm4"}]}],"versions":["2.78-1","2.78-3","2.79-1","2.79-1ubuntu0.2","2.79-1ubuntu0.3","2.79-1ubuntu0.4","2.79-1ubuntu0.5","2.79-1ubuntu0.6","2.79-1ubuntu0.7","2.90-0ubuntu0.18.04.1+esm1","2.90-0ubuntu0.18.04.1+esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.20.04.1+esm3"}]}],"versions":["2.80-1ubuntu2","2.80-1ubuntu4","2.80-1.1ubuntu1","2.80-1.1ubuntu1.2","2.80-1.1ubuntu1.3","2.80-1.1ubuntu1.4","2.80-1.1ubuntu1.5","2.80-1.1ubuntu1.6","2.80-1.1ubuntu1.7","2.90-0ubuntu0.20.04.1","2.90-0ubuntu0.20.04.1+esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.22.04.4"}]}],"versions":["2.85-1ubuntu2","2.86-1.1","2.86-1.1ubuntu0.1","2.86-1.1ubuntu0.2","2.86-1.1ubuntu0.3","2.86-1.1ubuntu0.4","2.86-1.1ubuntu0.5","2.90-0ubuntu0.22.04.1","2.90-0ubuntu0.22.04.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-2ubuntu0.4"}]}],"versions":["2.89-1","2.90-2","2.90-2build1","2.90-2build2","2.90-2ubuntu0.1","2.90-2ubuntu0.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.92-1ubuntu0.4"}]}],"versions":["2.91-1build1","2.92~rc3-1","2.92-1","2.92-1ubuntu0.2","2.92-1ubuntu0.3"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-2.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"thekelleys","product":"dnsmasq"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-12969","tags":["vdb-entry","x_refsource_REDHAT","Mitigation","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491663","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12969","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-wmwj-946w-3m8w"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-12969","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-12969","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0288.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35935","tags":["report"]},{"url":"https://app.opencve.io/cve/CVE-2026-12725","tags":["advisory"]},{"url":"https://app.opencve.io/cve/CVE-2026-12969","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8542-1","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490763","tags":["report"]},{"url":"https://thekelleys.org.uk/dnsmasq/CHANGELOG","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2963","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12725","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2966","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3087","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622668-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268882","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12969","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622706-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268764","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12725","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262974-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263028-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-12969","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-12725","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-12969","title":"Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation","description":"An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.","status":"published","published":"2026-06-23T13:28:56.732Z","modified":"2026-11-06T17:57:56.853Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-06T18:59:08.498645Z"}],"euvd":[{"id":"EUVD-2026-38449","description":"An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.","status":"published","published":"2026-06-23T13:28:56Z","modified":"2026-11-06T17:57:56Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-06T19:05:52.672747Z"}],"ghsa":[{"id":"GHSA-wmwj-946w-3m8w","title":"An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c....","description":"An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.","status":"published","published":"2026-06-23T15:32:37Z","modified":"2026-06-23T15:32:49Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:08:56.903887Z"}],"nvd":[{"id":"CVE-2026-12969","description":"An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.","status":"published","published":"2026-06-23T14:17:22.79Z","modified":"2026-11-06T18:18:06.69Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-06T20:01:12.161832Z"}],"osv":[{"id":"BELL-CVE-2026-12969","status":"published","published":"2026-06-24T06:11:28.500322Z","modified":"2026-07-17T07:15:06.486428033Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"DEBIAN-CVE-2026-12969","description":"An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.","status":"published","published":"2026-06-23T14:17:22.79Z","modified":"2026-11-07T09:47:34.013308989Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"OESA-2026-2963","title":"dnsmasq security update","description":"Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.\r\n\r\nSecurity Fix(es):\n\nA heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and\nquery logging are both enabled, logging of DS or DNSKEY replies containing\nunsupported algorithm or digest types can cause dnsmasq to write past the end\nof an internal logging buffer. A remote attacker able to supply such a DNS\nresponse may crash the dnsmasq process, resulting in denial of service.(CVE-2026-12725)\n\nAn out-of-bounds read vulnerability exists in dnsmasq\u0026apos;s find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.(CVE-2026-12969)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:16.928184594Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2966","title":"dnsmasq security update","description":"Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.\r\n\r\nSecurity Fix(es):\n\nA heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and\nquery logging are both enabled, logging of DS or DNSKEY replies containing\nunsupported algorithm or digest types can cause dnsmasq to write past the end\nof an internal logging buffer. A remote attacker able to supply such a DNS\nresponse may crash the dnsmasq process, resulting in denial of service.(CVE-2026-12725)\n\nAn out-of-bounds read vulnerability exists in dnsmasq\u0026apos;s find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.(CVE-2026-12969)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:16.996764951Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3087","title":"dnsmasq security update","description":"Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.\r\n\r\nSecurity Fix(es):\n\nA heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and\nquery logging are both enabled, logging of DS or DNSKEY replies containing\nunsupported algorithm or digest types can cause dnsmasq to write past the end\nof an internal logging buffer. A remote attacker able to supply such a DNS\nresponse may crash the dnsmasq process, resulting in denial of service.(CVE-2026-12725)\n\nAn out-of-bounds read vulnerability exists in dnsmasq\u0026apos;s find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.(CVE-2026-12969)","status":"published","published":"2026-07-19T11:11:58Z","modified":"2026-08-18T01:21:20.920386424Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"UBUNTU-CVE-2026-12969","description":"An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.","status":"published","published":"2026-06-23T14:17:00Z","modified":"2026-07-14T23:30:20.966207695Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"AZL-91164","title":"CVE-2026-12969 affecting package dnsmasq for versions less than 2.93-1","description":"An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.","status":"published","published":"2026-06-23T14:17:22Z","modified":"2026-08-28T17:56:31.743353Z","updated_at":"2026-11-02T15:28:11.397546Z"},{"id":"MGASA-2026-0288","title":"Updated dnsmasq packages fix security vulnerabilities","description":"The updated dnsmasq packages fix multiple security issues:\nA heap-based buffer overflow was found in dnsmasq. When DNSSEC\nvalidation and query logging are both enabled, logging of DS or DNSKEY\nreplies containing unsupported algorithm or digest types can cause\ndnsmasq to write past the end of an internal logging buffer.\nA remote attacker able to supply such a DNS response may crash the\ndnsmasq process, resulting in denial of service. (CVE-2026-12725)\nAn out-of-bounds read vulnerability exists in dnsmasq's find_soa()\nfunction in src/rfc1035.c. When parsing NS section records,\nextract_name() is called with extrabytes=0, failing to validate that 10\nadditional bytes exist for fixed-length DNS record fields. A remote\nattacker controlling a DNS zone can exploit this via a crafted NXDOMAIN\nresponse to cause a 10-byte heap out-of-bounds read, potentially\naccessing stale data from prior transactions. (CVE-2026-12969)\n","status":"published","published":"2026-07-23T17:45:56Z","modified":"2026-07-23T18:00:05.436377194Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11172-1","title":"dnsmasq-2.93-2.1 on GA media","description":"These are all security issues fixed in the dnsmasq-2.93-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-02T00:00:00Z","modified":"2026-07-03T11:00:05.366719325Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"SUSE-SU-2026:22668-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues\n\n- CVE-2026-12969: out-of-bounds read in `find_soa()` due to missing extrabytes validation (bsc#1268882).\n","status":"published","published":"2026-07-09T07:33:48Z","modified":"2026-07-21T18:48:03.200132948Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22706-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues\n\n- CVE-2026-12725: heap buffer overflow in `log_query()` when logging unsupported DS/DNSKEY replies (bsc#1268764).\n- CVE-2026-12969: out-of-bounds read in `find_soa()` due to missing extrabytes validation (bsc#1268882).\n\nChanges for dnsmasq:\n\n- Update to 2.93:\n\n * Fix a corner-case in DNSSEC validation with wildcards.\n * Fix DNSSEC failure with spurious RRSIGs.\n * Fix DNSSEC fail with CNAME replies to DS queries.\n * Fix regression in 2.92 release which broke DHCPv6 when a DHCP\n relay is in use.\n * Modify the inotify implementation so that inotify watches are\n only created after dnsmasq has changed permissions and userid.\n","status":"published","published":"2026-07-10T08:05:09Z","modified":"2026-07-23T18:24:14.858516662Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2974-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues\n\n- CVE-2026-12725: heap buffer overflow in `log_query()` when logging unsupported DS/DNSKEY replies (bsc#1268764).\n- CVE-2026-12969: out-of-bounds read in `find_soa()` due to missing extrabytes validation (bsc#1268882).\n\nChanges for dnsmasq:\n\n- Update to 2.93:\n * Fix a corner-case in DNSSEC validation with wildcards.\n * Fix DNSSEC failure with spurious RRSIGs.\n * Fix DNSSEC fail with CNAME replies to DS queries.\n * Fix regression in 2.92 release which broke DHCPv6 when a DHCP\n relay is in use.\n * Modify the inotify implementation so that inotify watches are\n only created after dnsmasq has changed permissions and userid.\n","status":"published","published":"2026-07-14T11:36:48Z","modified":"2026-07-15T10:00:08.830400568Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3028-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues\n\n- CVE-2026-12725: heap buffer overflow in `log_query()` when logging unsupported DS/DNSKEY replies (bsc#1268764).\n- CVE-2026-12969: out-of-bounds read in `find_soa()` due to missing extrabytes validation (bsc#1268882).\n\nChanges for dnsmasq:\n\n- Update to 2.93:\n * Fix a corner-case in DNSSEC validation with wildcards.\n * Fix DNSSEC failure with spurious RRSIGs.\n * Fix DNSSEC fail with CNAME replies to DS queries.\n * Fix regression in 2.92 release which broke DHCPv6 when a DHCP\n relay is in use.\n * Modify the inotify implementation so that inotify watches are\n only created after dnsmasq has changed permissions and userid.\n","status":"published","published":"2026-07-15T09:51:37Z","modified":"2026-07-16T10:00:06.722561235Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8542-1","title":"dnsmasq vulnerabilities","description":"Yiwei Hou discovered that Dnsmasq incorrectly handled logging of DS or\nDNSKEY. A remote attacker could possibly use this issue to cause a\ndenial of service. (CVE-2026-12725)\n\nIt was discovered that Dnsmasq incorrectly validated the length of\nfixed-length DNS record fields when parsing NS section records. A remote\nattacker could possibly use this issue to cause Dnsmasq to read out of\nbounds, possibly exposing sensitive information. (CVE-2026-12969)","status":"published","published":"2026-07-14T17:43:48Z","modified":"2026-07-15T04:05:20.571021518Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}