Executive brief
Dnsmasq is a widely used tool that provides network infrastructure services like DNS and DHCP to local networks. A flaw was found where the software can crash when it attempts to log specific types of security-related DNS records that it does not recognize. This could allow a remote attacker to disrupt internet connectivity or local network services by causing the dnsmasq process to stop working.
Technical details
A heap-based buffer overflow exists in the log_query() function within src/cache.c of dnsmasq. When query logging (--log-queries) and DNSSEC validation are both enabled, the software fails to properly bound the length of strings written to the internal 46-byte 'daemon->addrbuff' heap buffer. Specifically, when logging DS or DNSKEY replies containing IANA-unassigned or unsupported algorithm/digest types, the addition of a "(not supported)" suffix via sprintf() causes a write past the buffer end. While the overflow is bounded (approximately 12 bytes) and the content is not directly attacker-controlled, it can lead to heap corruption and process crashes. The issue is fixed in upstream version 2.92rel2 (commit 36d081e).
Affected products
- thekelleys.org.uk dnsmasq versions prior to 2.92rel2
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux 10
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-06-19: disclosed: Initial report in Red Hat Bugzilla
- 2026-06-22: advisory: NVD publication date
- 2026-06-22: patched: Upstream fix identified in version 2.92rel2