{"id":"CVE-2026-93011","aliases":["AZL-112421","DEBIAN-CVE-2026-93011","EUVD-2026-112789","GHSA-2jq5-wc7q-j2fc","UBUNTU-CVE-2026-93011","openSUSE-SU-2026:12415-1"],"status":"published","title":"Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms","description":"A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00634,"percentile":0.50841,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2026-10-29T12:47:10Z","modified":"2026-11-06T02:17:59Z","affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.93-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.89-1","2.90-1","2.90-2","2.90-3","2.90-4","2.90-4~deb12u1","2.90-4~deb12u2","2.90-5","2.90-6","2.90-7","2.91-1","2.91~test6-1","2.91~test9-1","2.92-1","2.92-1+exp1","2.92-1~exp1","2.92-2","2.92-3","2.92-4","2.92-5","2.92~rc1-1","2.92~rc3-1","2.93-1","2.93-2","2.93-3"]},{"source":"osv","ecosystem":"Debian:13","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.91-1","2.91-1+deb13u1","2.91-1+deb13u2","2.92-1","2.92-1+exp1","2.92-1~exp1","2.92-2","2.92-3","2.92-4","2.92-5","2.92~rc1-1","2.92~rc3-1","2.93-1","2.93-2","2.93-3"]},{"source":"osv","ecosystem":"Debian:14","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.91-1","2.92-1","2.92-1+exp1","2.92-1~exp1","2.92-2","2.92-3","2.92-4","2.92-5","2.92~rc1-1","2.92~rc3-1","2.93-1","2.93-2","2.93-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.66-4ubuntu1","2.67-1","2.68-1","2.68-1ubuntu0.1","2.68-1ubuntu0.2","2.68-1ubuntu0.2+esm1","2.68-1ubuntu0.2+esm2","2.68-1ubuntu0.2+esm3","2.68-1ubuntu0.2+esm5","2.68-1ubuntu0.2+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.75-1","2.75-1ubuntu0.16.04.1","2.75-1ubuntu0.16.04.2","2.75-1ubuntu0.16.04.3","2.75-1ubuntu0.16.04.4","2.75-1ubuntu0.16.04.5","2.75-1ubuntu0.16.04.7","2.75-1ubuntu0.16.04.8","2.75-1ubuntu0.16.04.10","2.75-1ubuntu0.16.04.10+esm1","2.79-1ubuntu0.16.04.1+esm1","2.79-1ubuntu0.16.04.1+esm2","2.90-0ubuntu0.16.04.1+esm1","2.90-0ubuntu0.16.04.1+esm3","2.90-0ubuntu0.16.04.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.78-1","2.78-3","2.79-1","2.79-1ubuntu0.2","2.79-1ubuntu0.3","2.79-1ubuntu0.4","2.79-1ubuntu0.5","2.79-1ubuntu0.6","2.79-1ubuntu0.7","2.90-0ubuntu0.18.04.1+esm1","2.90-0ubuntu0.18.04.1+esm3","2.90-0ubuntu0.18.04.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.80-1ubuntu2","2.80-1ubuntu4","2.80-1.1ubuntu1","2.80-1.1ubuntu1.2","2.80-1.1ubuntu1.3","2.80-1.1ubuntu1.4","2.80-1.1ubuntu1.5","2.80-1.1ubuntu1.6","2.80-1.1ubuntu1.7","2.90-0ubuntu0.20.04.1","2.90-0ubuntu0.20.04.1+esm2","2.90-0ubuntu0.20.04.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.85-1ubuntu2","2.86-1.1","2.86-1.1ubuntu0.1","2.86-1.1ubuntu0.2","2.86-1.1ubuntu0.3","2.86-1.1ubuntu0.4","2.86-1.1ubuntu0.5","2.90-0ubuntu0.22.04.1","2.90-0ubuntu0.22.04.3","2.90-0ubuntu0.22.04.4","2.91-0ubuntu0.22.04.1","2.91-0ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.89-1","2.90-2","2.90-2build1","2.90-2build2","2.90-2ubuntu0.1","2.90-2ubuntu0.3","2.90-2ubuntu0.4","2.91-0ubuntu0.24.04.1","2.91-0ubuntu0.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.92-1","2.93-1","2.93-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.91-1build1","2.92~rc3-1","2.92-1","2.92-1ubuntu0.2","2.92-1ubuntu0.3","2.92-1ubuntu0.4","2.92-1ubuntu0.5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dnsmasq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.93-3.1"}]}],"bundled":5}],"products":[{"vendor":"red hat","product":"red hat ceph storage 9"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"},{"vendor":"red hat","product":"red hat openstack platform 13 (queens)"},{"vendor":"red hat","product":"red hat openstack platform 18.0"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-93011","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536082","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93011","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2jq5-wc7q-j2fc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-93011","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-93011","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93011","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93011","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-93011","title":"Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms","description":"A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.","status":"published","published":"2026-10-29T12:47:10.17Z","modified":"2026-11-06T01:50:37.336Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-06T02:55:55.947181Z"}],"euvd":[{"id":"EUVD-2026-112789","description":"A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.","status":"published","published":"2026-10-29T12:47:10Z","modified":"2026-11-06T01:50:37Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-06T03:02:58.554056Z"}],"ghsa":[{"id":"GHSA-2jq5-wc7q-j2fc","title":"A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC...","description":"A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.","status":"published","published":"2026-10-29T15:30:51Z","modified":"2026-10-29T15:30:52Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:14:38.729227Z"}],"nvd":[{"id":"CVE-2026-93011","description":"A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.","status":"published","published":"2026-10-29T13:17:16.22Z","modified":"2026-11-06T02:17:59.61Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-06T06:59:07.128224Z"}],"osv":[{"id":"DEBIAN-CVE-2026-93011","description":"A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.","status":"published","published":"2026-10-29T13:17:16.22Z","modified":"2026-10-31T09:47:26.716899233Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:06.846102Z"},{"id":"UBUNTU-CVE-2026-93011","description":"A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.","status":"published","published":"2026-10-29T13:17:00Z","modified":"2026-11-05T04:38:27Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T13:33:42.748455Z"},{"id":"AZL-112421","title":"CVE-2026-93011 affecting package dnsmasq 2.93-1","description":"A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.","status":"published","published":"2026-10-29T13:17:16Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"openSUSE-SU-2026:12415-1","title":"dnsmasq-2.93-3.1 on GA media","description":"These are all security issues fixed in the dnsmasq-2.93-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-04T00:00:00Z","modified":"2026-11-05T17:23:17.426007732Z","updated_at":"2026-11-05T17:55:05.69587Z"}]}}