{"id":"CVE-2026-2291","aliases":["ALPINE-CVE-2026-2291","ALSA-2026:19158","ALSA-2026:19373","ALSA-2026:20589","AZL-86763","BELL-CVE-2026-2291","CLSA-2026-1779437548","CLSA-2026-1779437608","CLSA-2026-1779455055","DEBIAN-CVE-2026-2291","EUVD-2026-29091","GHSA-hjxh-hmm9-wcmc","MGASA-2026-0135","OESA-2026-2435","OESA-2026-2436","OESA-2026-2437","OESA-2026-2438","OESA-2026-2509","RHSA-2026:19158","RHSA-2026:19373","RHSA-2026:20589","RHSA-2026:34508","RLSA-2026:19158","RLSA-2026:19373","RLSA-2026:20589","SUSE-SU-2026:1826-1","SUSE-SU-2026:1827-1","SUSE-SU-2026:1828-1","SUSE-SU-2026:1934-1","SUSE-SU-2026:21626-1","SUSE-SU-2026:21633-1","SUSE-SU-2026:21640-1","SUSE-SU-2026:21677-1","SUSE-SU-2026:21733-1","SUSE-SU-2026:21788-1","SUSE-SU-2026:22454-1","SUSE-SU-2026:22496-1","SUSE-SU-2026:2458-1","UBUNTU-CVE-2026-2291","USN-8268-1","openSUSE-SU-2026:10821-1","openSUSE-SU-2026:20748-1","openSUSE-SU-2026:21192-1"],"status":"published","title":"CVE-2026-2291","description":"dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00611,"percentile":0.49538,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2026-05-11T12:00:00Z","modified":"2026-10-29T11:32:33Z","exploits":[{"source":"pocgithub","id":"JianrongXiao-Linksys/dnsmasq-cve-2026","title":"JianrongXiao-Linksys/dnsmasq-cve-2026","date":"2026-06-01","url":"https://github.com/JianrongXiao-Linksys/dnsmasq-cve-2026"}],"fixes":[{"ecosystem":"Alpine:v3.22","package":"dnsmasq","fixed_in":["2.91-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"dnsmasq","fixed_in":["2.91-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dnsmasq","fixed_in":["2.92_p2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"dnsmasq","fixed_in":["2.92-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"dnsmasq","fixed_in":["2.90-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"dnsmasq","fixed_in":["2.91-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"dnsmasq","fixed_in":["2.92_p2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"dnsmasq","fixed_in":["2.90-4~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dnsmasq","fixed_in":["2.91-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dnsmasq","fixed_in":["2.92-5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"dnsmasq","fixed_in":["2.68-1ubuntu0.2+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dnsmasq","fixed_in":["2.90-0ubuntu0.16.04.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dnsmasq","fixed_in":["2.90-0ubuntu0.18.04.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dnsmasq","fixed_in":["2.90-0ubuntu0.20.04.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"dnsmasq","fixed_in":["2.90-0ubuntu0.22.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"dnsmasq","fixed_in":["2.90-2ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"dnsmasq","fixed_in":["2.91-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"dnsmasq","fixed_in":["2.92-1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.91-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.91-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.92_p2-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-7.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dnsmasq-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-7.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.85-18.el9_8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dnsmasq-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.85-18.el9_8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.79-36.el8_10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dnsmasq-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.79-36.el8_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Azure Linux:3","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.92-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.87-r0"},{"fixed":"2.90-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.91-r0"},{"fixed":"2.91-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.89-r2"},{"fixed":"2.92_p2-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.85-17.el9_6.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"dnsmasq-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.85-17.el9_6.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.79-33.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"dnsmasq-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.79-33.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.85-6.el9_2.tuxcare.els3"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"dnsmasq-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.85-6.el9_2.tuxcare.els3"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-4~deb12u2"}]}],"versions":["2.89-1","2.90-1","2.90-2","2.90-3","2.90-4~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.91-1+deb13u1"}]}],"versions":["2.91-1"]},{"source":"osv","ecosystem":"Debian:14","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.92-5"}]}],"versions":["2.91-1","2.92-1","2.92-1+exp1","2.92-1~exp1","2.92-2","2.92-3","2.92-4","2.92~rc1-1","2.92~rc3-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.92rel2-1.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-8.oe2403"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-9.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.82-21.oe2003sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.86-15.oe2203sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-8.oe2403sp1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.90-7.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dnsmasq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.90-7.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dnsmasq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.90-7.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dnsmasq-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.90-7.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dnsmasq-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.90-7.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.85-18.el9_8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dnsmasq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.85-18.el9_8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dnsmasq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.85-18.el9_8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dnsmasq-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.85-18.el9_8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dnsmasq-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.85-18.el9_8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.79-36.el8_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dnsmasq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.79-36.el8_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dnsmasq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.79-36.el8_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dnsmasq-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.79-36.el8_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"dnsmasq-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.79-36.el8_10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.85-17.el9_6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dnsmasq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.85-17.el9_6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dnsmasq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.85-17.el9_6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dnsmasq-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.85-17.el9_6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"dnsmasq-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.85-17.el9_6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:10","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.90-7.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.85-18.el9_8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.79-36.el8_10"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-slfo.1.1_1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.92rel2-18.27.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.92rel2-18.27.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.68-1ubuntu0.2+esm5"}]}],"versions":["2.66-4ubuntu1","2.67-1","2.68-1","2.68-1ubuntu0.1","2.68-1ubuntu0.2","2.68-1ubuntu0.2+esm1","2.68-1ubuntu0.2+esm2","2.68-1ubuntu0.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.16.04.1+esm3"}]}],"versions":["2.75-1","2.75-1ubuntu0.16.04.1","2.75-1ubuntu0.16.04.2","2.75-1ubuntu0.16.04.3","2.75-1ubuntu0.16.04.4","2.75-1ubuntu0.16.04.5","2.75-1ubuntu0.16.04.7","2.75-1ubuntu0.16.04.8","2.75-1ubuntu0.16.04.10","2.75-1ubuntu0.16.04.10+esm1","2.79-1ubuntu0.16.04.1+esm1","2.79-1ubuntu0.16.04.1+esm2","2.90-0ubuntu0.16.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.18.04.1+esm3"}]}],"versions":["2.78-1","2.78-3","2.79-1","2.79-1ubuntu0.2","2.79-1ubuntu0.3","2.79-1ubuntu0.4","2.79-1ubuntu0.5","2.79-1ubuntu0.6","2.79-1ubuntu0.7","2.90-0ubuntu0.18.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.20.04.1+esm2"}]}],"versions":["2.80-1ubuntu2","2.80-1ubuntu4","2.80-1.1ubuntu1","2.80-1.1ubuntu1.2","2.80-1.1ubuntu1.3","2.80-1.1ubuntu1.4","2.80-1.1ubuntu1.5","2.80-1.1ubuntu1.6","2.80-1.1ubuntu1.7","2.90-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.22.04.3"}]}],"versions":["2.85-1ubuntu2","2.86-1.1","2.86-1.1ubuntu0.1","2.86-1.1ubuntu0.2","2.86-1.1ubuntu0.3","2.86-1.1ubuntu0.4","2.86-1.1ubuntu0.5","2.90-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-2ubuntu0.3"}]}],"versions":["2.89-1","2.90-2","2.90-2build1","2.90-2build2","2.90-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.91-1ubuntu0.2"}]}],"versions":["2.91-1","2.91-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.92-1ubuntu0.2"}]}],"versions":["2.91-1build1","2.92~rc3-1","2.92-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.68-1ubuntu0.2+esm5"}]}],"versions":["2.66-4ubuntu1","2.67-1","2.68-1","2.68-1ubuntu0.1","2.68-1ubuntu0.2","2.68-1ubuntu0.2+esm1","2.68-1ubuntu0.2+esm2","2.68-1ubuntu0.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.16.04.1+esm3"}]}],"versions":["2.75-1","2.75-1ubuntu0.16.04.1","2.75-1ubuntu0.16.04.2","2.75-1ubuntu0.16.04.3","2.75-1ubuntu0.16.04.4","2.75-1ubuntu0.16.04.5","2.75-1ubuntu0.16.04.7","2.75-1ubuntu0.16.04.8","2.75-1ubuntu0.16.04.10","2.75-1ubuntu0.16.04.10+esm1","2.79-1ubuntu0.16.04.1+esm1","2.79-1ubuntu0.16.04.1+esm2","2.90-0ubuntu0.16.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.18.04.1+esm3"}]}],"versions":["2.78-1","2.78-3","2.79-1","2.79-1ubuntu0.2","2.79-1ubuntu0.3","2.79-1ubuntu0.4","2.79-1ubuntu0.5","2.79-1ubuntu0.6","2.79-1ubuntu0.7","2.90-0ubuntu0.18.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.20.04.1+esm2"}]}],"versions":["2.80-1ubuntu2","2.80-1ubuntu4","2.80-1.1ubuntu1","2.80-1.1ubuntu1.2","2.80-1.1ubuntu1.3","2.80-1.1ubuntu1.4","2.80-1.1ubuntu1.5","2.80-1.1ubuntu1.6","2.80-1.1ubuntu1.7","2.90-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-0ubuntu0.22.04.3"}]}],"versions":["2.85-1ubuntu2","2.86-1.1","2.86-1.1ubuntu0.1","2.86-1.1ubuntu0.2","2.86-1.1ubuntu0.3","2.86-1.1ubuntu0.4","2.86-1.1ubuntu0.5","2.90-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.90-2ubuntu0.3"}]}],"versions":["2.89-1","2.90-2","2.90-2build1","2.90-2build2","2.90-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.91-1ubuntu0.2"}]}],"versions":["2.91-1","2.91-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.92-1ubuntu0.2"}]}],"versions":["2.91-1build1","2.92~rc3-1","2.92-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.92rel2-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-160000.1.1"}]}],"bundled":3}],"products":[{"vendor":"dnsmasq","product":"dnsmasq"}],"references":[{"url":"https://www.suse.com/security/cve/CVE-2026-2291.html","tags":["web"]},{"url":"https://www.kb.cert.org/vuls/id/471747","tags":["web"]},{"url":"https://thekelleys.org.uk/dnsmasq/CVE/","tags":["web"]},{"url":"https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html","tags":["web","article"]},{"url":"https://github.com/NixOS/nixpkgs/pull/519082","tags":["fix"]},{"url":"https://github.com/NixOS/nixpkgs/pull/519093","tags":["fix"]},{"url":"https://github.com/pi-hole/FTL/releases/tag/v6.6.2","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/20/14","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2291","tags":["web","advisory"]},{"url":"https://thekelleys.org.uk/dnsmasq/doc.html"},{"url":"https://thekelleys.org.uk/dnsmasq/CVE"},{"url":"https://github.com/advisories/GHSA-hjxh-hmm9-wcmc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-2291","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19158","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2291","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4890","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4891","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4892","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4893","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5172","tags":["report"]},{"url":"https://bugzilla.redhat.com/2439088","tags":["report"]},{"url":"https://bugzilla.redhat.com/2458516","tags":["report"]},{"url":"https://bugzilla.redhat.com/2458517","tags":["report"]},{"url":"https://bugzilla.redhat.com/2458518","tags":["report"]},{"url":"https://bugzilla.redhat.com/2458519","tags":["report"]},{"url":"https://bugzilla.redhat.com/2458521","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-19158.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19373","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-19373.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20589","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-20589.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-2291","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1779437548.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1779437608.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779455055.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2291.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-2291","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0135.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35520","tags":["report"]},{"url":"https://thekelleys.org.uk/dnsmasq/CHANGELOG","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2435","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4890","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4891","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4892","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4893","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5172","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2436","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2437","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2438","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2509","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2439088","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458516","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458517","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458519","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458521","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19158.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2291","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4890","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4891","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4892","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4893","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5172","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19373.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20589.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34508","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34508.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:19158","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:19373","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:20589","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261826-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258251","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2291","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261827-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261828-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261934-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1247812","tags":["report"]},{"url":"https://bugzilla.suse.com/1257934","tags":["report"]},{"url":"https://bugzilla.suse.com/1262487","tags":["report"]},{"url":"https://bugzilla.suse.com/1265001","tags":["report"]},{"url":"https://bugzilla.suse.com/1265002","tags":["report"]},{"url":"https://bugzilla.suse.com/1265003","tags":["report"]},{"url":"https://bugzilla.suse.com/1265004","tags":["report"]},{"url":"https://bugzilla.suse.com/1265006","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6507","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621626-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1226091","tags":["report"]},{"url":"https://bugzilla.suse.com/1235517","tags":["report"]},{"url":"https://bugzilla.suse.com/1235834","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49441","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621633-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621640-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621677-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621733-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621788-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622454-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268764","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12725","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622496-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262458-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-2291","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8268-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-4890","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-4891","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-4892","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-4893","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-5172","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-2291","title":"CVE-2026-2291","description":"dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.","status":"published","published":"2026-05-11T16:47:01.981Z","modified":"2026-07-20T20:30:02.766Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T13:48:46.911326Z"}],"euvd":[{"id":"EUVD-2026-29091","description":"dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.","status":"published","published":"2026-05-11T16:47:01Z","modified":"2026-07-20T20:30:02Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T18:19:47.959089Z"}],"ghsa":[{"id":"GHSA-hjxh-hmm9-wcmc","title":"dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an...","description":"dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.","status":"published","published":"2026-05-11T18:31:45Z","modified":"2026-07-20T21:31:40Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:09:36.920272Z"}],"nvd":[{"id":"CVE-2026-2291","description":"dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.","status":"published","published":"2026-05-11T18:16:31.363Z","modified":"2026-07-20T21:16:46.783Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:18.239974Z"}],"osv":[{"id":"ALPINE-CVE-2026-2291","description":"dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.","status":"published","published":"2026-05-11T18:16:31.363Z","modified":"2026-10-01T02:17:49.209719333Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-2291","status":"published","published":"2026-05-13T06:09:16.65209Z","modified":"2026-05-20T07:15:03.923480344Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-2291","title":"CVE-2026-2291","description":"dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.","status":"published","published":"2026-05-11T16:47:01.981Z","modified":"2026-10-28T02:30:46.6650258Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:44:58.749922Z"},{"id":"DEBIAN-CVE-2026-2291","description":"dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.","status":"published","published":"2026-05-11T18:16:31.363Z","modified":"2026-10-01T03:02:57.657859436Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"OESA-2026-2435","title":"dnsmasq security update","description":"Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.\r\n\r\nSecurity Fix(es):\n\ndnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.(CVE-2026-2291)\n\nA Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.(CVE-2026-4890)\n\nA heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.(CVE-2026-4891)\n\nA heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet.(CVE-2026-4892)\n\nAn information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information.(CVE-2026-4893)\n\nA buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the pointer past the record’s end.(CVE-2026-5172)","status":"published","published":"2026-05-22T11:11:23Z","modified":"2026-08-18T01:20:00.169045448Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2436","title":"dnsmasq security update","description":"Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.\r\n\r\nSecurity Fix(es):\n\ndnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.(CVE-2026-2291)\n\nA Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.(CVE-2026-4890)\n\nA heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.(CVE-2026-4891)\n\nA heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet.(CVE-2026-4892)\n\nAn information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information.(CVE-2026-4893)\n\nA buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the pointer past the record’s end.(CVE-2026-5172)","status":"published","published":"2026-05-22T11:11:23Z","modified":"2026-08-18T01:19:59.485982983Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2437","title":"dnsmasq security update","description":"Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.\r\n\r\nSecurity Fix(es):\n\ndnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.(CVE-2026-2291)\n\nA Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.(CVE-2026-4890)\n\nA heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.(CVE-2026-4891)\n\nA heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet.(CVE-2026-4892)\n\nAn information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information.(CVE-2026-4893)","status":"published","published":"2026-05-22T11:11:23Z","modified":"2026-08-18T01:19:59.427391022Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2438","title":"dnsmasq security update","description":"Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.\r\n\r\nSecurity Fix(es):\n\ndnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.(CVE-2026-2291)\n\nA Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.(CVE-2026-4890)\n\nA heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.(CVE-2026-4891)\n\nA heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet.(CVE-2026-4892)\n\nAn information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information.(CVE-2026-4893)","status":"published","published":"2026-05-22T11:11:23Z","modified":"2026-08-18T01:19:59.633620961Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2509","title":"dnsmasq security update","description":"Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portable hotspots, and to support virtual networking in virtualisation frameworks.\r\n\r\nSecurity Fix(es):\n\ndnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.(CVE-2026-2291)\n\nA Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.(CVE-2026-4890)\n\nA heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.(CVE-2026-4891)\n\nA heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet.(CVE-2026-4892)\n\nAn information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information.(CVE-2026-4893)\n\nA buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the pointer past the record’s end.(CVE-2026-5172)","status":"published","published":"2026-05-29T11:11:27Z","modified":"2026-08-18T01:20:01.506751198Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:19158","title":"Red Hat Security Advisory: dnsmasq security update","status":"published","published":"2026-05-20T10:10:08Z","modified":"2026-10-17T10:10:19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:19373","title":"Red Hat Security Advisory: dnsmasq security update","status":"published","published":"2026-05-20T10:10:42Z","modified":"2026-10-17T10:10:26Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:20589","title":"Red Hat Security Advisory: dnsmasq security update","status":"published","published":"2026-05-26T10:07:41Z","modified":"2026-10-17T10:10:45Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:34508","title":"Red Hat Security Advisory: dnsmasq security update","status":"published","published":"2026-07-02T10:17:48Z","modified":"2026-10-17T10:12:26Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RLSA-2026:19158","title":"Important: dnsmasq security update","description":"The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.\n\nSecurity Fix(es):\n\n* dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)\n\n* dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)\n\n* dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)\n\n* dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)\n\n* dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)\n\n* dnsmasq: extract_addresses() OOB read via malformed rdlen (CVE-2026-5172)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-29T16:03:24.060458Z","modified":"2026-05-29T16:30:35.94569861Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:19373","title":"Important: dnsmasq security update","description":"The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.\n\nSecurity Fix(es):\n\n* dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)\n\n* dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)\n\n* dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)\n\n* dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)\n\n* dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-28T15:43:06.024531Z","modified":"2026-05-28T16:00:31.590637106Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:20589","title":"Important: dnsmasq security update","description":"The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.\n\nSecurity Fix(es):\n\n* dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)\n\n* dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)\n\n* dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)\n\n* dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)\n\n* dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-29T00:00:29.215827Z","modified":"2026-05-29T00:30:04.780203744Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-2291","description":"dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.","status":"published","published":"2026-05-11T12:00:00Z","modified":"2026-05-20T16:24:13.855625652Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"ALSA-2026:19158","title":"Important: dnsmasq security update","description":"The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.  \n\nSecurity Fix(es):  \n\n  * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)\n  * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)\n  * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)\n  * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)\n  * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)\n  * dnsmasq: extract_addresses() OOB read via malformed rdlen (CVE-2026-5172)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:30:24.143431891Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:19373","title":"Important: dnsmasq security update","description":"The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.  \n\nSecurity Fix(es):  \n\n  * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)\n  * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)\n  * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)\n  * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)\n  * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:32:33.911345585Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:20589","title":"Important: dnsmasq security update","description":"The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.  \n\nSecurity Fix(es):  \n\n  * dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)\n  * dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)\n  * dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)\n  * dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)\n  * dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-26T00:00:00Z","modified":"2026-10-29T11:02:23.533504758Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"AZL-86763","title":"CVE-2026-2291 affecting package dnsmasq for versions less than 2.92-1","description":"dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.","status":"published","published":"2026-05-11T18:16:31Z","modified":"2026-10-22T15:09:00Z","updated_at":"2026-11-02T15:28:10.677811Z"},{"id":"CLSA-2026-1779437548","title":"dnsmasq: Fix of 5 CVEs","description":"- CVE-2026-2291: fix buffer overflow in union bigname\n- CVE-2026-4890: fix NSEC bitmap parsing infinite loop and OOB reads\n- CVE-2026-4891: verify rdlen field in RRSIG packets\n- CVE-2026-4892: fix buffer overflow in helper.c with large CLIDs\n- CVE-2026-4893: fix broken client subnet validation","status":"published","published":"2026-05-22T08:12:32Z","modified":"2026-06-01T00:32:54.402584685Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779437608","title":"dnsmasq: Fix of 5 CVEs","description":"- CVE-2026-2291: fix buffer overflow in union bigname\n- CVE-2026-4890: fix NSEC bitmap parsing infinite loop and OOB reads\n- CVE-2026-4891: verify rdlen field in RRSIG packets\n- CVE-2026-4892: fix buffer overflow in helper.c with large CLIDs\n- CVE-2026-4893: fix broken client subnet validation","status":"published","published":"2026-05-22T08:13:33Z","modified":"2026-06-01T00:33:15.186949815Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779455055","title":"dnsmasq: Fix of 5 CVEs","description":"- CVE-2026-2291: heap OOB write via undersized union bigname buffer\n- CVE-2026-4890: dnssec NSEC bitmap parsing infinite loop\n- CVE-2026-4891: dnssec missing rdlen validation in RRSIG records\n- CVE-2026-4892: helper buffer overflow with large DHCPv6 CLIDs\n- CVE-2026-4893: broken client subnet validation in process_reply","status":"published","published":"2026-05-22T13:04:19Z","modified":"2026-06-01T00:32:34.283446845Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"MGASA-2026-0135","title":"Updated dnsmasq packages fix security vulnerabilities","description":"CVE-2026-2291: dnsmasqs extract_name() function can be abused to cause a\nheap buffer overflow, allowing an attacker to inject false DNS cache\nentries, which could result in DNS lookups to redirect to an\nattacker-controlled IP address, or to cause a DoS.\n        CVE-2026-4890: A Denial of Service (DoS) vulnerability in the\nDNSSEC validation of dnsmasq allows remote attackers to cause a denial\nof service via a crafted DNS packet.\n        CVE-2026-4891: A heap-based out-of-bounds read vulnerability in\nthe DNSSEC validation of dnsmasq allows remote attackers to cause a\ndenial of service via a crafted DNS packet.\n        CVE-2026-4892: A heap-based out-of-bounds write vulnerability in\nthe DHCPv6 implementation of dnsmasq allows local attackers to execute\narbitrary code with root privileges via a crafted DHCPv6 packet.\n        CVE-2026-4893: An information disclosure vulnerability in\ndnsmasq allows remote attackers to bypass source checks via a crafted\nDNS packet with RFC 7871 client subnet information.\n        CVE-2026-5172: A buffer overflow in dnsmasq’s\nextract_addresses() function allows an attacker to trigger a heap\nout-of-bounds read and crash by exploiting a malformed DNS response,\nenabling extract_name() to advance the pointer past the record’s end.\n","status":"published","published":"2026-05-14T02:43:25Z","modified":"2026-05-14T02:45:20.443426Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10821-1","title":"dnsmasq-2.92rel2-1.1 on GA media","description":"These are all security issues fixed in the dnsmasq-2.92rel2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-20T00:00:00Z","modified":"2026-05-21T08:15:08.478841096Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20748-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-2291: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect\n  (bsc#1258251).\n- CVE-2026-4890: DoS vulnerability in the DNSSEC validation (bsc#1265001).\n- CVE-2026-4891: heap-based out-of-bounds read vulnerability in the DNSSEC validation (bsc#1265002).\n- CVE-2026-4892: heap-based out-of-bounds write vulnerability in the DHCPv6 implementation (bsc#1265003).\n- CVE-2026-4893: information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks\n  (bsc#1265004).\n- CVE-2026-5172: buffer overflow in dnsmasq's extract_addresses() function (bsc#1265006).\n- CVE-2026-6507: out-of-bounds write in DHCP BOOTREPLY processing can lead to denial of service (bsc#1262487).\n\nNon security issues:\n\n- aardvark-dns upstream tests make dnsmasq dump core (bsc#1247812).\n- Drop rcFOO symlinks for CODE16 (jsc#PED-266.\n- libnettle: update to 4.0 breaks dnsmasq and gnutls (bsc#1257934).\n- unknown user or group: dnsmasq with latest proposed dnsmasq update when doing virsh net-start (bsc#1235517).\n- Update to security release 2.92rel2.\n","status":"published","published":"2026-05-13T16:33:13Z","modified":"2026-05-19T18:23:48.128076889Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:21192-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues\n\nUpdate to 2.93:\n\n- CVE-2026-12725: heap buffer overflow in `log_query()` when logging unsupported DS/DNSKEY replies (bsc#1268764).\n\nChanges for dnsmasq:\n\n * CVE-2026-12725, bsc#1268764: Heap buffer overflow in\n `log_query()` when logging unsupported DS/DNSKEY replies.\n * Fix a corner-case in DNSSEC validation with wildcards.\n * Fix DNSSEC failure with spurious RRSIGs.\n * Fix DNSSEC fail with CNAME replies to DS queries.\n * Fix regression in 2.92 release which broke DHCPv6 when a DHCP\n relay is in use.\n * Modify the inotify implementation so that inotify watches are\n only created after dnsmasq has changed permissions and userid.\n * CVE-2026-2291: Rework storage allocation for domain names.\n","status":"published","published":"2026-06-29T07:41:58Z","modified":"2026-07-03T18:24:23.808557419Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:1826-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issue:\n\n- CVE-2026-2291: VU#471747: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect\n  (bsc#1258251).\n","status":"published","published":"2026-05-12T09:04:30Z","modified":"2026-05-14T08:16:08.098613Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:1827-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issue:\n\n- CVE-2026-2291: VU#471747: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect\n  (bsc#1258251).\n","status":"published","published":"2026-05-12T09:05:52Z","modified":"2026-05-14T08:16:10.641821Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:1828-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issue:\n\n- CVE-2026-2291: VU#471747: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect\n  (bsc#1258251).\n","status":"published","published":"2026-05-12T09:07:06Z","modified":"2026-05-14T08:15:53.640022Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:1934-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-4890: DoS vulnerability in the DNSSEC validation (bsc#1265001).\n- CVE-2026-4891: heap-based out-of-bounds read vulnerability in the DNSSEC validation (bsc#1265002).\n- CVE-2026-4892: heap-based out-of-bounds write vulnerability in the DHCPv6 implementation (bsc#1265003).\n- CVE-2026-4893: information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks\n  (bsc#1265004).\n- CVE-2026-5172: buffer overflow in dnsmasq's extract_addresses() function (bsc#1265006).\n- CVE-2026-6507: out-of-bounds write in DHCP BOOTREPLY processing can lead to denial of service (bsc#1262487).\n\nNon security issues:\n\n- Updated to security release 2.92rel2.\n- aardvark-dns upstream tests make dnsmasq dump core (bsc#1247812).\n- Drop rcFOO symlinks for CODE16 (jsc#PED-266).\n- libnettle: update to 4.0 breaks dnsmasq and gnutls (bsc#1257934).\n","status":"published","published":"2026-05-18T07:40:10Z","modified":"2026-05-19T08:45:07.254454446Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:21626-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues:\n\nSecurity issues:\n\n- CVE-2023-49441: integer overflow via forward_query (bsc#1226091).\n- CVE-2026-2291: VU#471747: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect\n  (bsc#1258251).\n\nNon security issue:\n\n- Reintroduce nogroup (bsc#1235517).\n","status":"published","published":"2026-05-12T09:38:42Z","modified":"2026-05-16T18:25:33.857819Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21633-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues:\n\n- CVE-2026-2291: Fixed a bug that could have been abused to record false cached data enabling DoS or attacker redirect. (bsc#1258251)\n","status":"published","published":"2026-05-12T09:27:01Z","modified":"2026-05-16T18:25:39.253079Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21640-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-2291: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect\n  (bsc#1258251).\n- CVE-2026-4890: DoS vulnerability in the DNSSEC validation (bsc#1265001).\n- CVE-2026-4891: heap-based out-of-bounds read vulnerability in the DNSSEC validation (bsc#1265002).\n- CVE-2026-4892: heap-based out-of-bounds write vulnerability in the DHCPv6 implementation (bsc#1265003).\n- CVE-2026-4893: information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks\n  (bsc#1265004).\n- CVE-2026-5172: buffer overflow in dnsmasq's extract_addresses() function (bsc#1265006).\n- CVE-2026-6507: out-of-bounds write in DHCP BOOTREPLY processing can lead to denial of service (bsc#1262487).\n\nNon security issues:\n\n- aardvark-dns upstream tests make dnsmasq dump core (bsc#1247812).\n- Drop rcFOO symlinks for CODE16 (jsc#PED-266.\n- libnettle: update to 4.0 breaks dnsmasq and gnutls (bsc#1257934).\n- unknown user or group: dnsmasq with latest proposed dnsmasq update when doing virsh net-start (bsc#1235517).\n- Update to security release 2.92rel2.\n","status":"published","published":"2026-05-13T16:34:00Z","modified":"2026-05-16T18:25:49.625952Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21677-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-2291: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect\n  (bsc#1258251).\n- CVE-2026-4890: DoS vulnerability in the DNSSEC validation (bsc#1265001).\n- CVE-2026-4891: heap-based out-of-bounds read vulnerability in the DNSSEC validation (bsc#1265002).\n- CVE-2026-4892: heap-based out-of-bounds write vulnerability in the DHCPv6 implementation (bsc#1265003).\n- CVE-2026-4893: information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks\n  (bsc#1265004).\n- CVE-2026-5172: buffer overflow in dnsmasq's extract_addresses() function (bsc#1265006).\n- CVE-2026-6507: out-of-bounds write in DHCP BOOTREPLY processing can lead to denial of service (bsc#1262487).\n\nNon security issues:\n\n- aardvark-dns upstream tests make dnsmasq dump core (bsc#1247812).\n- Drop rcFOO symlinks for CODE16 (jsc#PED-266).\n- libnettle: update to 4.0 breaks dnsmasq and gnutls (bsc#1257934).\n\nChanges for dnsmasq:\n\n- Update to security release 2.92rel2\n","status":"published","published":"2026-05-15T10:44:28Z","modified":"2026-05-20T18:23:55.697682444Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21733-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-2291: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect\n  (bsc#1258251).\n- CVE-2026-4890: DoS vulnerability in the DNSSEC validation (bsc#1265001).\n- CVE-2026-4891: heap-based out-of-bounds read vulnerability in the DNSSEC validation (bsc#1265002).\n- CVE-2026-4892: heap-based out-of-bounds write vulnerability in the DHCPv6 implementation (bsc#1265003).\n- CVE-2026-4893: information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks\n  (bsc#1265004).\n- CVE-2026-5172: buffer overflow in dnsmasq's extract_addresses() function (bsc#1265006).\n- CVE-2026-6507: out-of-bounds write in DHCP BOOTREPLY processing can lead to denial of service (bsc#1262487).\n\nNon security issues:\n\n- aardvark-dns upstream tests make dnsmasq dump core (bsc#1247812).\n- Drop rcFOO symlinks for CODE16 (jsc#PED-266).\n- libnettle: update to 4.0 breaks dnsmasq and gnutls (bsc#1257934).\n\nChanges for dnsmasq:\n\n- Update to security release 2.92rel2\n","status":"published","published":"2026-05-19T11:42:27Z","modified":"2026-05-23T18:23:40.378661943Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21788-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-2291: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect\n  (bsc#1258251).\n- CVE-2026-4890: DoS vulnerability in the DNSSEC validation (bsc#1265001).\n- CVE-2026-4891: heap-based out-of-bounds read vulnerability in the DNSSEC validation (bsc#1265002).\n- CVE-2026-4892: heap-based out-of-bounds write vulnerability in the DHCPv6 implementation (bsc#1265003).\n- CVE-2026-4893: information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks\n  (bsc#1265004).\n- CVE-2026-5172: buffer overflow in dnsmasq's extract_addresses() function (bsc#1265006).\n- CVE-2026-6507: out-of-bounds write in DHCP BOOTREPLY processing can lead to denial of service (bsc#1262487).\n\nNon security issues:\n\n- aardvark-dns upstream tests make dnsmasq dump core (bsc#1247812).\n- Drop rcFOO symlinks for CODE16 (jsc#PED-266.\n- libnettle: update to 4.0 breaks dnsmasq and gnutls (bsc#1257934).\n- unknown user or group: dnsmasq with latest proposed dnsmasq update when doing virsh net-start (bsc#1235517).\n- Update to security release 2.92rel2.\n","status":"published","published":"2026-05-13T16:34:00Z","modified":"2026-05-28T18:24:08.539527583Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22454-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues\n\nUpdate to 2.93:\n\n- CVE-2026-12725: heap buffer overflow in `log_query()` when logging unsupported DS/DNSKEY replies (bsc#1268764).\n","status":"published","published":"2026-06-30T11:07:00Z","modified":"2026-07-04T18:24:20.228328735Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22496-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues\n\nUpdate to 2.93:\n\n- CVE-2026-12725: heap buffer overflow in `log_query()` when logging unsupported DS/DNSKEY replies (bsc#1268764).\n\nChanges for dnsmasq:\n\n * CVE-2026-12725, bsc#1268764: Heap buffer overflow in\n `log_query()` when logging unsupported DS/DNSKEY replies.\n * Fix a corner-case in DNSSEC validation with wildcards.\n * Fix DNSSEC failure with spurious RRSIGs.\n * Fix DNSSEC fail with CNAME replies to DS queries.\n * Fix regression in 2.92 release which broke DHCPv6 when a DHCP\n relay is in use.\n * Modify the inotify implementation so that inotify watches are\n only created after dnsmasq has changed permissions and userid.\n * CVE-2026-2291: Rework storage allocation for domain names.\n","status":"published","published":"2026-06-29T07:42:51Z","modified":"2026-07-07T18:24:06.577068313Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2458-1","title":"Security update for dnsmasq","description":"This update for dnsmasq fixes the following issues\n\n- CVE-2026-2291: VU#471747: dnsmasq can be abused to record false cached data enabling DoS or attacker redirect\n  (bsc#1258251).\n- CVE-2026-4890: DoS vulnerability in the DNSSEC validation (bsc#1265001).\n- CVE-2026-4891: heap-based out-of-bounds read vulnerability in the DNSSEC validation (bsc#1265002).\n- CVE-2026-4892: heap-based out-of-bounds write vulnerability in the DHCPv6 implementation (bsc#1265003).\n- CVE-2026-4893: information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks\n  (bsc#1265004).\n- CVE-2026-5172: buffer overflow in dnsmasq's extract_addresses() function (bsc#1265006).\n- CVE-2026-6507: out-of-bounds write in DHCP BOOTREPLY processing can lead to denial of service (bsc#1262487).\n  \nChanges for dnsmasq:\n\n- Update to security release 2.92rel2.\n- Fix setting of compile time options from the spec file.\n","status":"published","published":"2026-06-18T15:54:25Z","modified":"2026-06-19T08:15:07.13608017Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"USN-8268-1","title":"dnsmasq vulnerabilities","description":"Andrew S. Fasano, Royce M, and Hugo Martinez Ray discovered that Dnsmasq\ndid not allocate the necessary space to store domain names in some\ncontexts. An attacker could possibly use this issue to write\nout-of-bounds, and could cause a denial of service or execute arbitrary\ncode. (CVE-2026-2291)\n\nRoyce M discovered that Dnsmasq could loop infinitely due to erroneously\nmissing the window header. An attacker could possibly use this issue to\ncause a denial of service. This issue only affected Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,\nUbuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-4890)\n\nRoyce M discovered that a maliciously crafted packet could cause Dnsmasq\nto report a negative length. An attacker could possibly use this issue\nto cause a denial of service. This issue only affected Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,\nUbuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-4891)\n\nRoyce M and Asim Viladi Oglu Manizada discovered that certain\nconfigurations of Dnsmasq could write over the DHCPv6 CLID buffer within\na privileged helper. An attacker could possibly use this issue to cause\na denial of service or execute arbitrary code. (CVE-2026-4892)\n\nRoyce M discovered that certain configurations of Dnsmasq could bypass\ninternal bounds checks. An attacker could possibly use this issue to\npermit malformed packets, and could cause a denial of service.\n(CVE-2026-4893)\n\nHugo Martinez discovered that Dnsmasq did not check the rdlen element of\na record. An attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and\nUbuntu 26.04 LTS. (CVE-2026-5172)","status":"published","published":"2026-05-12T09:23:25Z","modified":"2026-06-30T18:16:01.282957206Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}