CVE-2026-13002
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A flow in the dnssec.c library causes an infinite loop in the dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dnsmasq process with a single crafted response, killing all DNS resolution for its clients.
Risk Assessment
The risk is complete denial of service for DNS resolution, preventing clients from resolving names and potentially affecting all DNS-dependent services.
Recommendation
Immediately update dnsmasq to a patched version and monitor DNS traffic for suspicious responses.
Original NVD description (English source)
A flow has been identified into dnssec.c library, causing an infinite loop to dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dnsmasq process with a single crafted response, killing all DNS resolution for its clients.