CVE-2026-4893
MediumCVSS 5.3Summary
An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet carrying RFC 7871 client subnet information. The flaw enables circumvention of query origin verification mechanisms.
Risk Assessment
A remote attacker may bypass source checks and potentially disclose information or influence DNS responses. This can weaken security mechanisms that rely on verifying the source of DNS queries.
Recommendation
Update dnsmasq to a version containing the fix for this vulnerability. Until patched, consider limiting exposure of the DNS service to untrusted networks.
Other vulnerabilities in dnsmasq
See all- CVE-2017-14496High
An integer underflow in the add_pseudoheader function in dnsmasq before version 2.78 allows remote attackers to cause a denial of service via a crafted DNS request when the --add-mac, --add-cpe-id, or --add-subnet option is specified.
- CVE-2017-14495High
A memory leak in dnsmasq before version 2.78 occurs when the --add-mac, --add-cpe-id, or --add-subnet option is specified. This allows remote attackers to cause a denial of service through DNS response creation manipulation.
- CVE-2017-13704High
In dnsmasq before version 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zeros, causing dnsmasq to crash.
- CVE-2015-8899High
Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.
- CVE-2026-4891Medium
A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.
- CVE-2026-4890High
The DNSSEC validation in dnsmasq has a denial of service (DoS) vulnerability. A remote attacker can send a crafted DNS packet, causing the service to crash.
- CVE-2017-14491Critical
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
- CVE-2017-14493Critical
A stack-based buffer overflow in dnsmasq before version 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.
- CVE-2017-14492Critical
Heap-based buffer overflow in dnsmasq before version 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.
- CVE-2026-93010Medium
A flaw was found in dnsmasq: when DHCP leasequery is enabled without an allowed source address list, the server does not verify who sent the query. A host on the local network can query DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator enables it.
Original NVD description (English source)
An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS