{"id":"CVE-2026-93009","aliases":["AZL-112430","DEBIAN-CVE-2026-93009","EUVD-2026-112826","GHSA-6qrc-rpqw-59wp","UBUNTU-CVE-2026-93009","openSUSE-SU-2026:12415-1"],"status":"published","title":"Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder","description":"A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00202,"percentile":0.10258,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125"],"published":"2026-10-29T13:13:34Z","modified":"2026-11-05T17:23:17Z","affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.93-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.89-1","2.90-1","2.90-2","2.90-3","2.90-4","2.90-4~deb12u1","2.90-4~deb12u2","2.90-5","2.90-6","2.90-7","2.91-1","2.91~test6-1","2.91~test9-1","2.92-1","2.92-1+exp1","2.92-1~exp1","2.92-2","2.92-3","2.92-4","2.92-5","2.92~rc1-1","2.92~rc3-1","2.93-1","2.93-2","2.93-3"]},{"source":"osv","ecosystem":"Debian:13","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.91-1","2.91-1+deb13u1","2.91-1+deb13u2","2.92-1","2.92-1+exp1","2.92-1~exp1","2.92-2","2.92-3","2.92-4","2.92-5","2.92~rc1-1","2.92~rc3-1","2.93-1","2.93-2","2.93-3"]},{"source":"osv","ecosystem":"Debian:14","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.91-1","2.92-1","2.92-1+exp1","2.92-1~exp1","2.92-2","2.92-3","2.92-4","2.92-5","2.92~rc1-1","2.92~rc3-1","2.93-1","2.93-2","2.93-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.66-4ubuntu1","2.67-1","2.68-1","2.68-1ubuntu0.1","2.68-1ubuntu0.2","2.68-1ubuntu0.2+esm1","2.68-1ubuntu0.2+esm2","2.68-1ubuntu0.2+esm3","2.68-1ubuntu0.2+esm5","2.68-1ubuntu0.2+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.75-1","2.75-1ubuntu0.16.04.1","2.75-1ubuntu0.16.04.2","2.75-1ubuntu0.16.04.3","2.75-1ubuntu0.16.04.4","2.75-1ubuntu0.16.04.5","2.75-1ubuntu0.16.04.7","2.75-1ubuntu0.16.04.8","2.75-1ubuntu0.16.04.10","2.75-1ubuntu0.16.04.10+esm1","2.79-1ubuntu0.16.04.1+esm1","2.79-1ubuntu0.16.04.1+esm2","2.90-0ubuntu0.16.04.1+esm1","2.90-0ubuntu0.16.04.1+esm3","2.90-0ubuntu0.16.04.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.78-1","2.78-3","2.79-1","2.79-1ubuntu0.2","2.79-1ubuntu0.3","2.79-1ubuntu0.4","2.79-1ubuntu0.5","2.79-1ubuntu0.6","2.79-1ubuntu0.7","2.90-0ubuntu0.18.04.1+esm1","2.90-0ubuntu0.18.04.1+esm3","2.90-0ubuntu0.18.04.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.80-1ubuntu2","2.80-1ubuntu4","2.80-1.1ubuntu1","2.80-1.1ubuntu1.2","2.80-1.1ubuntu1.3","2.80-1.1ubuntu1.4","2.80-1.1ubuntu1.5","2.80-1.1ubuntu1.6","2.80-1.1ubuntu1.7","2.90-0ubuntu0.20.04.1","2.90-0ubuntu0.20.04.1+esm2","2.90-0ubuntu0.20.04.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.85-1ubuntu2","2.86-1.1","2.86-1.1ubuntu0.1","2.86-1.1ubuntu0.2","2.86-1.1ubuntu0.3","2.86-1.1ubuntu0.4","2.86-1.1ubuntu0.5","2.90-0ubuntu0.22.04.1","2.90-0ubuntu0.22.04.3","2.90-0ubuntu0.22.04.4","2.91-0ubuntu0.22.04.1","2.91-0ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.89-1","2.90-2","2.90-2build1","2.90-2build2","2.90-2ubuntu0.1","2.90-2ubuntu0.3","2.90-2ubuntu0.4","2.91-0ubuntu0.24.04.1","2.91-0ubuntu0.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.92-1","2.93-1","2.93-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.91-1build1","2.92~rc3-1","2.92-1","2.92-1ubuntu0.2","2.92-1ubuntu0.3","2.92-1ubuntu0.4","2.92-1ubuntu0.5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-3.1"}]}],"bundled":5}],"products":[{"vendor":"red hat","product":"red hat ceph storage 9"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"},{"vendor":"red hat","product":"red hat openstack platform 13 (queens)"},{"vendor":"red hat","product":"red hat openstack platform 18.0"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-93009","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536083","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93009","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6qrc-rpqw-59wp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-93009","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-93009","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93009","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93011","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-93009","title":"Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder","description":"A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.","status":"published","published":"2026-10-29T13:13:34.504Z","modified":"2026-11-06T19:57:49.419Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-06T20:30:05.375225Z"}],"euvd":[{"id":"EUVD-2026-112826","description":"A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.","status":"published","published":"2026-10-29T13:13:34Z","modified":"2026-11-06T19:57:49Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-06T21:07:00.111123Z"}],"ghsa":[{"id":"GHSA-6qrc-rpqw-59wp","title":"A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of...","description":"A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.","status":"published","published":"2026-10-29T15:30:54Z","modified":"2026-10-29T15:30:59Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:14:38.729227Z"}],"nvd":[{"id":"CVE-2026-93009","description":"A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.","status":"published","published":"2026-10-29T14:18:00.367Z","modified":"2026-11-06T20:17:29.21Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-06T22:02:15.550386Z"}],"osv":[{"id":"DEBIAN-CVE-2026-93009","description":"A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.","status":"published","published":"2026-10-29T14:18:00.367Z","modified":"2026-11-07T09:47:32.361928115Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"UBUNTU-CVE-2026-93009","description":"A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.","status":"published","published":"2026-10-29T14:18:00Z","modified":"2026-11-05T04:38:27Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T13:33:42.748455Z"},{"id":"AZL-112430","title":"CVE-2026-93009 affecting package dnsmasq 2.93-1","description":"A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.","status":"published","published":"2026-10-29T14:18:00Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"openSUSE-SU-2026:12415-1","title":"dnsmasq-2.93-3.1 on GA media","description":"These are all security issues fixed in the dnsmasq-2.93-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-04T00:00:00Z","modified":"2026-11-05T17:23:17.426007732Z","updated_at":"2026-11-05T17:55:05.69587Z"}]}}